Skip to content
OpenAdvisories
Medium USN-8601-1 1 CVE

pam vulnerability

Published Jul 23, 2026 · Updated Jul 24, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PAM had a timing discrepancy in the pam_userdb
module when comparing plaintext passwords. An attacker could possibly use
this issue to obtain sensitive information by measuring response-timing
differences during repeated authentication attempts.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS pam 1.4.0-11ubuntu2.7
Ubuntu · 24.04 LTS 24.04:LTS pam 1.5.3-5ubuntu5.6
Ubuntu · 26.04 LTS 26.04:LTS pam 1.7.0-5ubuntu3.1

Vulnerabilities 1

  • Medium 5.9
    CVE-2026-54411

    Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

    Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authenticati…

    Linux-PAM Linux-PAM pam pam Linux Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2026-54411