Skip to content
OpenAdvisories
Medium ELSA-2026-56131 1 CVE

Moderate: pam security update (Oracle Linux 8)

Published Aug 18, 2026 · Updated Aug 18, 2026

Ecosystem: Oracle Linux

Summary

[1.3.1-40.0.1]
- pam_limits: fix use after free in pam_sm_open_session [Orabug: 36272695]

[1.3.1-40]
- pam_userdb: fix password comparison timing leak.
Resolves: CVE-2026-54411 and RHEL-191699

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 8 pam 0:1.3.1-40.0.1.el8_10
Oracle Linux · 8 pam-devel 0:1.3.1-40.0.1.el8_10

Vulnerabilities 1

  • Medium 5.9
    CVE-2026-54411

    Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

    Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authenticati…

    Linux-PAM Linux-PAM pam pam Linux Debian Ubuntu Azure Linux