Skip to content
OpenAdvisories
Medium ELSA-2026-59379 1 CVE

Moderate: pam security update (Oracle Linux 10)

Published Aug 25, 2026 · Updated Aug 25, 2026

Ecosystem: Oracle Linux

Summary

[1.6.1-9.1]
- pam_userdb: fix password comparison timing leak.
Resolves: CVE-2026-54411 and RHEL-191704

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 10 pam 0:1.6.1-9.el10_2.1
Oracle Linux · 10 pam-devel 0:1.6.1-9.el10_2.1
Oracle Linux · 10 pam-libs 0:1.6.1-9.el10_2.1

Vulnerabilities 1

  • Medium 5.9
    CVE-2026-54411

    Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

    Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authenticati…

    Linux-PAM Linux-PAM pam pam Linux Debian Ubuntu Azure Linux