RHSA-2026:60224: Moderate: pam security update

Q: What information could an attacker recover through this issue?

The issue allows plaintext password recovery through a timing discrepancy in the pam_userdb module.

Q: Which component needs to be present for this issue to be relevant?

The affected component identified in the advisory is the pam_userdb module in PAM. The provided data does not state which PAM configurations enable or use this module.

Q: Which Red Hat packages are listed in the advisory?

The advisory lists redhat/pam, redhat/pam-debuginfo, redhat/pam-debugsource, redhat/pam-devel, and redhat/pam-docs, along with specified Red Hat Enterprise Linux offerings.

Published Aug 26, 2026

Updated

Moderate: pam security update

Other sources

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.Security Fix(es): linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module (CVE-2026-54411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

— Red Hat

Affected Software

36 affected componentsFixes available

Red Hat Red Hat Enterprise Linux for x86_64

Red Hat Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions

Red Hat Red Hat Enterprise Linux for IBM z Systems - Extended Update Support

Red Hat Red Hat Enterprise Linux for Power, little endian

Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Update Support

Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for ARM 64

Red Hat Red Hat Enterprise Linux for Power, little endian - Extended Update Support

Red Hat Red Hat Enterprise Linux for IBM z Systems - 4 years of updates

Red Hat Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for IBM z Systems

Red Hat Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions

Red Hat Red Hat Enterprise Linux for x86_64 - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for x86_64 - Extended Update Support

Red Hat Red Hat Enterprise Linux for ARM 64 - 4 years of updates

Red Hat Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle

redhat/pam<1.5.1-27.el9_8.1

1.5.1-27.el9_8.1

redhat/pam<1.5.1-27.el9_8.1

1.5.1-27.el9_8.1

redhat/pam-debuginfo<1.5.1-27.el9_8.1

1.5.1-27.el9_8.1

redhat/pam-debuginfo<1.5.1-27.el9_8.1

1.5.1-27.el9_8.1

redhat/pam-debugsource<1.5.1-27.el9_8.1

1.5.1-27.el9_8.1

redhat/pam-debugsource<1.5.1-27.el9_8.1

1.5.1-27.el9_8.1

redhat/pam-devel<1.5.1-27.el9_8.1

1.5.1-27.el9_8.1

redhat/pam-devel<1.5.1-27.el9_8.1

1.5.1-27.el9_8.1

redhat/pam-docs<1.5.1-27.el9_8.1

1.5.1-27.el9_8.1

redhat/pam-docs<1.5.1-27.el9_8.1

1.5.1-27.el9_8.1

redhat/pam<1.5.1-27.el9_8.1

1.5.1-27.el9_8.1

redhat/pam-debuginfo<1.5.1-27.el9_8.1

1.5.1-27.el9_8.1

redhat/pam-debugsource<1.5.1-27.el9_8.1

1.5.1-27.el9_8.1

redhat/pam-devel<1.5.1-27.el9_8.1

1.5.1-27.el9_8.1

redhat/pam-docs<1.5.1-27.el9_8.1

1.5.1-27.el9_8.1

redhat/pam<1.5.1-27.el9_8.1.aa

1.5.1-27.el9_8.1.aa

redhat/pam-debuginfo<1.5.1-27.el9_8.1.aa

1.5.1-27.el9_8.1.aa

redhat/pam-debugsource<1.5.1-27.el9_8.1.aa

1.5.1-27.el9_8.1.aa

redhat/pam-devel<1.5.1-27.el9_8.1.aa

1.5.1-27.el9_8.1.aa

redhat/pam-docs<1.5.1-27.el9_8.1.aa

1.5.1-27.el9_8.1.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/pam to a version that resolves this vulnerability.
Fixed in 1.5.1-27.el9_8.1
Upgrade
Upgrade redhat/pam-debuginfo to a version that resolves this vulnerability.
Fixed in 1.5.1-27.el9_8.1
Upgrade
Upgrade redhat/pam-debugsource to a version that resolves this vulnerability.
Fixed in 1.5.1-27.el9_8.1
Upgrade
Upgrade redhat/pam-devel to a version that resolves this vulnerability.
Fixed in 1.5.1-27.el9_8.1
Upgrade
Upgrade redhat/pam-docs to a version that resolves this vulnerability.
Fixed in 1.5.1-27.el9_8.1
Upgrade
Upgrade redhat/pam to a version that resolves this vulnerability.
Fixed in 1.5.1-27.el9_8.1.aa
Upgrade
Upgrade redhat/pam-debuginfo to a version that resolves this vulnerability.
Fixed in 1.5.1-27.el9_8.1.aa
Upgrade
Upgrade redhat/pam-debugsource to a version that resolves this vulnerability.
Fixed in 1.5.1-27.el9_8.1.aa
Upgrade
Upgrade redhat/pam-devel to a version that resolves this vulnerability.
Fixed in 1.5.1-27.el9_8.1.aa
Upgrade
Upgrade redhat/pam-docs to a version that resolves this vulnerability.
Fixed in 1.5.1-27.el9_8.1.aa

Event History

Aug 26, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·10:11 AM

Data Sourced

via Red Hat·10:11 AM

Severity

Frequently Asked Questions

What information could an attacker recover through this issue?

The issue allows plaintext password recovery through a timing discrepancy in the pam_userdb module.

Which component needs to be present for this issue to be relevant?

The affected component identified in the advisory is the pam_userdb module in PAM. The provided data does not state which PAM configurations enable or use this module.

Which Red Hat packages are listed in the advisory?

The advisory lists redhat/pam, redhat/pam-debuginfo, redhat/pam-debugsource, redhat/pam-devel, and redhat/pam-docs, along with specified Red Hat Enterprise Linux offerings.

RHSA-2026:60224: Moderate: pam security update

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What information could an attacker recover through this issue?

Which component needs to be present for this issue to be relevant?

Which Red Hat packages are listed in the advisory?

Company

Resources

Contact

Frequently Asked Questions

What information could an attacker recover through this issue?

Which component needs to be present for this issue to be relevant?

Which Red Hat packages are listed in the advisory?