RHSA-2026:61227: Moderate: pam security update
Moderate: pam security update
Other sources
Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.Security Fix(es): linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module (CVE-2026-54411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pamto a version that resolves this vulnerability.Fixed in 1.1.8-23.el7_9.3 - Upgrade
Upgrade
redhat/pam-debuginfoto a version that resolves this vulnerability.Fixed in 1.1.8-23.el7_9.3 - Upgrade
Upgrade
redhat/pam-develto a version that resolves this vulnerability.Fixed in 1.1.8-23.el7_9.3
Event History
Frequently Asked Questions
What must be present for this issue to be relevant?
The affected system must use the pam_userdb PAM module. The issue is a timing discrepancy that can enable plaintext password recovery.
Which systems or packages should be checked?
Check installations of redhat/pam and related pam-devel or pam-debuginfo packages on the listed Red Hat Enterprise Linux Server Extended Life Cycle Support offerings, including IBM z Systems and IBM Power variants.