A use‑after‑free flaw in the Kerberos Credential Manager responder of SSSD was discovered. The vulnerability occurs during ticket‑granting ticket renewal when a deferred callback accesses memory that has already been freed, allowing an authenticated local user possessing a renewable Kerberos ticket to cause the responder service to crash. The crash results in a denial of service that can interrupt authentication services on the affected host.

The flaw affects multiple Red Hat ecosystems, including Red Hat Enterprise Linux releases 6 through 10 and the Red Hat OpenShift Container Platform 4. All configurations that enable KCM ticket renewal on these platforms are vulnerable. Specific package versions are not enumerated in the advisory.

The CVSS base score of 4.7 indicates a moderate severity, and the vulnerability requires local authentication with a renewable Kerberos ticket to be exercised, making exploitation unlikely against anonymous users. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation risk. Nevertheless, the potential for a service crash suggests that affected systems should be considered within a higher risk posture while a patch is applied.