CVE-2026-54411: Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pamuserdb module's plaintext-password comparison path in modules/pamuserdb/pamuserdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the pam_userdb configuration so plaintext comparison is not used: do not set crypt=none and do not configure an unrecognized or missing crypt= argument; specify a recognized crypt= method so pam_userdb does not store/compare credentials in plaintext.
Linux-PAM pam_userdb crypt = (avoid crypt=none / ensure a recognized crypt= method is configured) - Compensating control
To reduce exposure, limit who can repeatedly drive authentication attempts against the target account via the calling service (e.g., apply rate-limiting/monitoring and restrict access from network-adjacent sources) to make response-timing measurement impractical.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54411?
CVE-2026-54411 has a medium severity rating of 5.9.
How does CVE-2026-54411 affect Linux-PAM?
CVE-2026-54411 introduces a timing discrepancy in the pam_userdb module's plaintext-password comparison, which can be exploited by attackers.
What is the risk associated with CVE-2026-54411?
The risk associated with CVE-2026-54411 is rated at 35, suggesting a moderate level of concern for systems using the affected software.
How do I mitigate CVE-2026-54411?
To mitigate CVE-2026-54411, update to a patched version of Linux-PAM that resolves the observed timing discrepancy.
Who is affected by CVE-2026-54411?
Users and administrators of Linux-PAM versions prior to 1.7.2 are potentially affected by CVE-2026-54411.