Skip to content
OpenAdvisories
Medium ALSA-2026:56131 1 CVE

Moderate: pam security update

Published Aug 18, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

* linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 8 pam 1.3.1-40.el8_10
AlmaLinux · 8 pam-devel 1.3.1-40.el8_10

Vulnerabilities 1

  • Medium 5.9
    CVE-2026-54411

    Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

    Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authenticati…

    Linux-PAM Linux-PAM pam pam Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-54411
  • report
    https://bugzilla.redhat.com/2488766
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-56131.html