Summary: Improper hostname canonicalization in util-linux login(1) when invoked with -h can modify the supplied remote hostname before setting PAMRHOST, potentially allowing bypass of host-based PAM access control rules (e.g., pamaccess) that rely on fully qualified domain names.

Requirements to exploit: An attacker must be able to access a remote login pathway that invokes login(1) with the -h <remotehost> option (e.g., telnet/rlogin-style daemons or custom wrappers). The target system must use PAM modules relying on PAMRHOST for authorization decisions (such as pamaccess) and have rules that distinguish between FQDNs and short hostnames. The local system hostname must share the same domain suffix as the attacker-supplied hostname.