RHSA-2026:61223: Moderate: pam security update
Moderate: pam security update
Other sources
Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.Security Fix(es): linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module (CVE-2026-54411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pamto a version that resolves this vulnerability.Fixed in 1.3.1-16.el8_6.4 - Upgrade
Upgrade
redhat/pam-debuginfoto a version that resolves this vulnerability.Fixed in 1.3.1-16.el8_6.4 - Upgrade
Upgrade
redhat/pam-debugsourceto a version that resolves this vulnerability.Fixed in 1.3.1-16.el8_6.4 - Upgrade
Upgrade
redhat/pam-develto a version that resolves this vulnerability.Fixed in 1.3.1-16.el8_6.4
Event History
Frequently Asked Questions
Which PAM component is implicated in the security fix?
The issue is identified in the pam_userdb module, where a timing discrepancy can allow plaintext password recovery.
Which related PAM packages are listed in the advisory?
The listed software includes redhat/pam, redhat/pam-debuginfo, redhat/pam-debugsource, and redhat/pam-devel.
Which Red Hat Enterprise Linux offerings are named as affected?
The advisory lists Red Hat Enterprise Linux for x86_64 Extended Life Cycle Long Life and Red Hat Enterprise Linux Server AUS.