Description
A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | linux-pam | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Red Hat Web Terminal 1.11 on RHEL 9 | — | — |
| Red Hat | Red Hat Web Terminal 1.12 on RHEL 9 | — | — |
| Red Hat | cert-manager operator for Red Hat OpenShift 1.16 | — | — |
| Red Hat | Compliance Operator 1 | — | — |
| Red Hat | Red Hat Discovery 2 | — | — |
| Red Hat | Red Hat Insights proxy 1.5 | — | — |
| Red Hat | Red Hat OpenShift sandboxed containers 1.1 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pam | No fix yet | — |
| Debian 13 | pam | No fix yet | — |
| Debian 12 | pam | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | pam +2 | 1.5.1-26.el9_6 | RHSA-2025:15099 |
| RHEL 8 | pam +1 | 1.3.1-38.el8_10 | RHSA-2025:14557 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | pam +2 | 1.5.1-24.el9_4.1 | RHSA-2025:15102 |
| RHEL 9.2 E4S | pam +2 | 1.5.1-15.el9_2.2 | RHSA-2025:15101 |
| RHEL 9.0 E4S | pam +2 | 1.5.1-9.el9_0.3 | RHSA-2025:15100 |
| RHEL 8.8 TUS | pam +1 | 1.3.1-26.el8_8.2 | RHSA-2025:15103 |
| RHEL 8.8 E4S | pam +1 | 1.3.1-26.el8_8.2 | RHSA-2025:15103 |
| RHEL 8.6 TUS | pam +1 | 1.3.1-16.el8_6.3 | RHSA-2025:15105 |
| RHEL 8.6 E4S | pam +1 | 1.3.1-16.el8_6.3 | RHSA-2025:15105 |
| RHEL 8.6 AUS | pam +1 | 1.3.1-16.el8_6.3 | RHSA-2025:15105 |
| RHEL 8.4 EUS Long Life | pam +1 | 1.3.1-14.el8_4.2 | RHSA-2025:15104 |
| RHEL 8.4 AUS | pam +1 | 1.3.1-14.el8_4.2 | RHSA-2025:15104 |
| RHEL 8.2 AUS | pam +1 | 1.3.1-8.el8_2.2 | RHSA-2025:15107 |
| RHEL 7 ELS | pam +1 | 1.1.8-23.el7_9.2 | RHSA-2025:15106 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | pam +2 | 1.5.1-26.el9_6 | ALSA-2025:15099 |
| AlmaLinux 8 | pam +1 | 1.3.1-38.el8_10 | ALSA-2025:14557 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | pam | 1.5.1-26.el9_6 | RLSA-2025:15099 |
| Rocky Linux 8 | pam | 1.3.1-38.el8_10 | RLSA-2025:14557 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | pam +2 | 1.5.1-8.amzn2023.0.7 | ALAS2023-2025-1257 |
| Amazon Linux 2 | pam +1 | 1.1.8-23.amzn2.0.5 | ALAS2-2025-3057 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | pam +2 | 1.5.1-26.0.1.el9_6 | ELSA-2025-15099 |
Advisories 18
- ALSA-2025:15099 Important: pam security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:14557 Important: pam security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:15107 Red Hat Security Advisory: pam security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:15105 Red Hat Security Advisory: pam security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:15106 Red Hat Security Advisory: pam security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:15104 Red Hat Security Advisory: pam security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:15102 Red Hat Security Advisory: pam security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:15103 Red Hat Security Advisory: pam security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:15100 Red Hat Security Advisory: pam security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:15101 Red Hat Security Advisory: pam security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:15099 Red Hat Security Advisory: pam security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:14557 Red Hat Security Advisory: pam security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2025-1828 PAM (linux-pam package): Schwachstelle ermöglicht Erlangen von Administratorrechten BSI CERT-Bund (WID) · Jan 21, 2026
- ALAS2-2025-3057 Moderate: pam security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 10, 2025
- ALAS2023-2025-1257 Moderate: pam security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 10, 2025
- RLSA-2025:15099 Important: pam security update Rocky Linux Security Advisories · Oct 10, 2025
- RLSA-2025:14557 Important: pam security update Rocky Linux Security Advisories · Sep 8, 2025
- ELSA-2025-15099 Important: pam security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 3, 2025
References
- RHSA-2025:14557 vendor-advisory
- RHSA-2025:15099 vendor-advisory
- RHSA-2025:15100 vendor-advisory
- RHSA-2025:15101 vendor-advisory
- RHSA-2025:15102 vendor-advisory
- RHSA-2025:15103 vendor-advisory
- RHSA-2025:15104 vendor-advisory
- RHSA-2025:15105 vendor-advisory
- RHSA-2025:15106 vendor-advisory
- RHSA-2025:15107 vendor-advisory
- RHSA-2025:15709 vendor-advisory
- RHSA-2025:15827 vendor-advisory
- RHSA-2025:15828 vendor-advisory
- RHSA-2025:16524 vendor-advisory
- RHSA-2025:17181 vendor-advisory
- RHSA-2025:18219 vendor-advisory
- RHSA-2025:21885 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-8941 vdb-entry
- RHBZ#2388220 issue-tracking