This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-68743 →
UBUNTU-CVE-2026-68743
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining b...
Original description
The description as published by the source.
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:16.04:LTS
sssd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-1ubuntu1.15+esm1"}]}]
Ubuntu:Pro:18.04:LTS
sssd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-1ubuntu1.8+esm1"}]}]
Ubuntu:Pro:20.04:LTS
sssd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-3ubuntu0.13+esm1"}]}]
Ubuntu:22.04:LTS
sssd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1ubuntu3.9"}]}]
Ubuntu:24.04:LTS
sssd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-1.1ubuntu6.8"}]}]
Ubuntu:26.04:LTS
sssd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-1ubuntu5.4"}]}]
References
- advisory ubuntu.com
- report ubuntu.com
- report cve.org
- report bugzilla.redhat.com
- report access.redhat.com