Red Hat Security Advisory

RHSA-2026:61226

pam security update

Released 2026-08-31 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.2) pam-devel-1.5.1-15.el9_2.3, pam-docs-1.5.1-15.el9_2.3
Red Hat Enterprise Linux BaseOS E4S (v.9.2) pam-1.5.1-15.el9_2.3

Fixes 1 record

TI-2026-39287 CVE-2026-54411 · GHSA-56gg-22rq-q53x

Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

LOW 30

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacke…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0032 Published 2026-06-14 Partial fix CWE-208