RHSA-2026:56131: Moderate: pam security update
Moderate: pam security update
Other sources
Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.Security Fix(es): linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module (CVE-2026-54411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pamto a version that resolves this vulnerability.Fixed in 1.3.1-40.el8_10 - Upgrade
Upgrade
redhat/pam-debuginfoto a version that resolves this vulnerability.Fixed in 1.3.1-40.el8_10 - Upgrade
Upgrade
redhat/pam-debugsourceto a version that resolves this vulnerability.Fixed in 1.3.1-40.el8_10 - Upgrade
Upgrade
redhat/pam-develto a version that resolves this vulnerability.Fixed in 1.3.1-40.el8_10 - Upgrade
Upgrade
redhat/pamto a version that resolves this vulnerability.Fixed in 1.3.1-40.el8_10.aa - Upgrade
Upgrade
redhat/pam-debuginfoto a version that resolves this vulnerability.Fixed in 1.3.1-40.el8_10.aa - Upgrade
Upgrade
redhat/pam-debugsourceto a version that resolves this vulnerability.Fixed in 1.3.1-40.el8_10.aa - Upgrade
Upgrade
redhat/pam-develto a version that resolves this vulnerability.Fixed in 1.3.1-40.el8_10.aa - Upgrade
Upgrade
linux-pamto a version that resolves this vulnerability.Patch CVE-2026-54411
Event History
Frequently Asked Questions
Which environments are covered by this advisory?
Systems using the affected Red Hat PAM packages are exposed where the pam_userdb module is used for authentication. The advisory lists Red Hat Enterprise Linux for ARM 64 Extended Life Cycle, Power little endian, IBM z Systems, and Power little endian Extended Life Cycle.
What does an attacker need to exploit this issue?
The issue is a timing discrepancy in pam_userdb that can allow plaintext password recovery. The provided advisory data does not state the required attacker access level, whether remote exploitation is possible, or whether pam_userdb is enabled by default.
How can I determine whether my system uses the affected component?
Review PAM configurations to determine whether pam_userdb is referenced by authentication policies. The advisory data does not provide a mitigation or workaround for systems that cannot yet be updated.