TI-2026-39287 CVE-2026-54411 · GHSA-56gg-22rq-q53x
Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison
Priority LOW 30
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacke…