Summary
Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.
Security Fix(es):
* linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | pam | 1.6.1-9.el10_2.1 |
| AlmaLinux · 10 | pam-devel | 1.6.1-9.el10_2.1 |
| AlmaLinux · 10 | pam-libs | 1.6.1-9.el10_2.1 |
Vulnerabilities 1
-
Medium 5.9
Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authenticati…