Description
A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | pam | < 1.1.8-24.71.1 | 1.1.8-24.71.1 |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | gdm | 45.0.1-150700.12.5.1 | SUSE-SU-2025:02005-1 |
| SLES 15 SP7 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLES 15 SP7 | pam-config | 1.1-150600.16.8.1 | SUSE-SU-2025:02080-1 |
| SLES 15 SP7 | pam_pkcs11 | 0.6.10-150600.16.8.1 | SUSE-SU-2025:02026-1 |
| SLES 15 SP6 | gdm | 45.0.1-150600.6.8.1 | SUSE-SU-2025:02003-1 |
| SLES 15 SP6 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLES 15 SP6 | pam-config | 1.1-150600.16.8.1 | SUSE-SU-2025:02080-1 |
| SLES 15 SP6 | pam_pkcs11 | 0.6.10-150600.16.8.1 | SUSE-SU-2025:02026-1 |
| SLES 15 SP5 | gdm | 41.3-150400.4.14.1 | SUSE-SU-2025:02004-1 |
| SLES 15 SP5 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLES 15 SP5 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SLES 15 SP5 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
| SLES 15 SP4 | gdm | 41.3-150400.4.14.1 | SUSE-SU-2025:02004-1 |
| SLES 15 SP4 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLES 15 SP4 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SLES 15 SP4 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
| SLES 15 SP3 | gdm | 3.34.1-150200.8.26.1 | SUSE-SU-2025:02015-1 |
| SLES 15 SP3 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLES 15 SP3 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SLES 15 SP3 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
Show 17 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | gdm | 3.10.0.1-54.23.1 | SUSE-SU-2025:02002-1 |
| SLES 12 SP5 | pam | 1.1.8-24.71.1 | SUSE-SU-2025:02001-1 |
| SLES 12 SP5 | pam-config | 0.89-5.8.1 | SUSE-SU-2025:02081-1 |
| SLES 12 SP5 | pam_pkcs11 | 0.6.8-7.13.1 | SUSE-SU-2025:02032-1 |
| SLES for SAP 15 SP5 | gdm | 41.3-150400.4.14.1 | SUSE-SU-2025:02004-1 |
| SLES for SAP 15 SP5 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLES for SAP 15 SP5 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SLES for SAP 15 SP5 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
| SLES for SAP 15 SP4 | gdm | 41.3-150400.4.14.1 | SUSE-SU-2025:02004-1 |
| SLES for SAP 15 SP4 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLES for SAP 15 SP4 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SLES for SAP 15 SP4 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
| SLES for SAP 15 SP3 | gdm | 3.34.1-150200.8.26.1 | SUSE-SU-2025:02015-1 |
| SLES for SAP 15 SP3 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLES for SAP 15 SP3 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SLES for SAP 15 SP3 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
| SLE Micro 6.1 | pam-config | 2.11+git.20240906-slfo.1.1_2.1 | SUSE-SU-2025:20533-1 |
| SLE Micro 6.1 | pam_pkcs11 | 0.6.12-slfo.1.1_4.1 | SUSE-RU-2025:20479-1 |
| SLE Micro 6.0 | pam-config | 2.11-2.1 | SUSE-SU-2025:20513-1 |
| SLE Micro 6.0 | pam_pkcs11 | 0.6.12-5.1 | SUSE-SU-2025:20496-1 |
| SLE Micro 5.5 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLE Micro 5.5 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SLE Micro 5.5 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
| SLE Micro 5.4 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLE Micro 5.4 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SLE Micro 5.4 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
| SLE Micro 5.3 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLE Micro 5.3 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SLE Micro 5.3 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
| SLE Micro 5.2 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLE Micro 5.2 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SLE Micro 5.2 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
| SLE Micro 5.1 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLE Micro 5.1 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SLE Micro 5.1 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
| SLE HPC 15 SP5 | gdm | 41.3-150400.4.14.1 | SUSE-SU-2025:02004-1 |
| SLE HPC 15 SP5 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLE HPC 15 SP5 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SLE HPC 15 SP5 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
| SLE HPC 15 SP4 | gdm | 41.3-150400.4.14.1 | SUSE-SU-2025:02004-1 |
| SLE HPC 15 SP4 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLE HPC 15 SP4 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SLE HPC 15 SP4 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
| SLE HPC 15 SP3 | gdm | 3.34.1-150200.8.26.1 | SUSE-SU-2025:02015-1 |
| SLE HPC 15 SP3 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SLE HPC 15 SP3 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SLE HPC 15 SP3 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
| SUSE Manager Server 4.3 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SUSE Manager Server 4.3 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SUSE Manager Server 4.3 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
| SUSE Manager Proxy 4.3 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SUSE Manager Proxy 4.3 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SUSE Manager Proxy 4.3 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
| SUSE Enterprise Storage 7.1 | gdm | 3.34.1-150200.8.26.1 | SUSE-SU-2025:02015-1 |
| SUSE Enterprise Storage 7.1 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| SUSE Enterprise Storage 7.1 | pam-config | 1.1-150200.3.14.1 | SUSE-SU-2025:02082-1 |
| SUSE Enterprise Storage 7.1 | pam_pkcs11 | 0.6.10-150100.3.11.1 | SUSE-SU-2025:02031-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gdm | 48.0-10.1 | openSUSE-SU-2025:15219-1 |
| openSUSE Tumbleweed | pam_pkcs11 | 0.6.13-2.1 | openSUSE-SU-2025:15257-1 |
| openSUSE Leap 15.6 | gdm | 45.0.1-150600.6.8.1 | SUSE-SU-2025:02003-1 |
| openSUSE Leap 15.6 | pam | 1.3.0-150000.6.83.1 | SUSE-SU-2025:02013-1 |
| openSUSE Leap 15.6 | pam-config | 1.1-150600.16.8.1 | SUSE-SU-2025:02080-1 |
| openSUSE Leap 15.6 | pam_pkcs11 | 0.6.10-150600.16.8.1 | SUSE-SU-2025:02026-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Linux PAM Environment - Variable Injection Local Privilege Escalation EDB-52386 · local · Jul 28, 2025
GitHub 14 repositories · most starred shown
-
MichaelVenturella/CVE-2025-6018-6019-PoC ★ 16 · Feb 9, 2026
A Proof of Concept for chaining CVE-2025-6018 (PAM/Polkit Active Session Bypass) and CVE-2025-6019 (libblockdev SUID Mount Flaw) to achieve Local Privilege Escalation (LPE) on vulnerable Linux system…
-
muyuanlove/CVE-2025-6018-CVE-2025-6019-Privilege-Escalation-Exploit ★ 12 · Feb 9, 2026
CVE-2025-6018 + CVE-2025-6019 Privilege Escalation Exploit
-
dreysanox/CVE-2025-6018_Poc ★ 6 · Jul 3, 2025
Exploit for CVE-2025-6019
-
DesertDemons/CVE-2025-6018-6019 ★ 5 · Feb 12, 2026
CVE-2025-6018 CVE-2025-6019 PoC Exploit - Local Privilege Escalation in openSUSE/SUSE Linux Enterprise 15 - PAM bypass + udisks2 XFS race condition LPE to root
-
Goultarde/CVE-2025-6018_CVE-2025-6019_autopwn ★ 4 · Feb 10, 2026
Auto exploit for CVE-2025-6018 & CVE-2025-6019 based on https://github.com/0rionCollector/Exploit-Chain-CVE-2025-6018-6019
-
0rionCollector/Exploit-Chain-CVE-2025-6018-6019 ★ 4 · Feb 9, 2026
Exploit Chain of CVE-2025-6018 to CVE-2025-6019
-
localh0ste/CVE-2025-6018-and-CVE-2025-6019 ★ 1 · Feb 13, 2026
Vulnerability chaining leads to privilege escalation
-
AzureADTrent/CVE-2025-6018-and-CVE-2025-6019-Privilege-Escalation ★ 1 · Feb 9, 2026
This is just a quick note on how to exploit these vulnerabilities to get root.
-
iamgithubber/CVE-2025-6018-19-exploit ★ 1 · Jul 3, 2025
-
euxem/Analyse-faille-de-s-curit-CVE-2025-6018-CVE-2025-6019 ★ 0 · Nov 30, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 20
- openSUSE-SU-2025:15257-1 pam_pkcs11-0.6.13-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15219-1 gdm-48.0-10.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20533-1 Security update for pam-config SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02003-1 Security update for gdm SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20513-1 Security update for pam-config SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-RU-2025:20479-1 Recommended update for pam_pkcs11 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02001-1 Security update for pam SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02080-1 Security update for pam-config SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02004-1 Security update for gdm SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02081-1 Security update for pam-config SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02082-1 Security update for pam-config SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20496-1 Security update for pam_pkcs11 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02002-1 Security update for gdm SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02005-1 Security update for gdm SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02026-1 Security update for pam_pkcs11 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02032-1 Security update for pam_pkcs11 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02015-1 Security update for gdm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02031-1 Security update for pam_pkcs11 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02013-1 Security update for pam SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1354 Verschiedene Linux Distributionen: Mehrere Schwachstellen ermöglichen Privilegieneskalation BSI CERT-Bund (WID) · Nov 4, 2025