--- id: CVE-2026-54411 title: >- Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeate… summary: >- Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeate… severity: medium cvss: 5.9 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N' cwe: - CWE-208 published: '2026-06-14' updated: '2026-08-10' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54411' references: - url: 'https://cwe.mitre.org/data/definitions/208.html' label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c - url: 'https://github.com/linux-pam/linux-pam' label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c - url: >- https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c - url: >- https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327 label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54411.json - url: 'https://access.redhat.com/security/cve/CVE-2026-54411' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2488766' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-54411' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54411' - url: 'https://access.redhat.com/errata/RHSA-2026:61227' - url: 'https://access.redhat.com/errata/RHSA-2026:61229' - url: 'https://access.redhat.com/errata/RHSA-2026:59379' - url: 'https://access.redhat.com/errata/RHSA-2026:61226' - url: 'https://access.redhat.com/errata/RHSA-2026:61228' - url: 'https://access.redhat.com/errata/RHSA-2026:61230' - url: 'https://access.redhat.com/errata/RHSA-2026:60224' - url: 'https://access.redhat.com/errata/RHSA-2026:64815' - url: 'https://access.redhat.com/errata/RHSA-2026:56131' - url: 'https://access.redhat.com/errata/RHSA-2026:61224' - url: 'https://access.redhat.com/errata/RHSA-2026:61223' - url: 'https://access.redhat.com/errata/RHSA-2026:61225' - url: 'https://access.redhat.com/errata/RHSA-2026:7553' tags: - nvd - csaf - vex - red-hat epss: 0.005 epssPercentile: 0.40256 ingestedAt: '2026-08-10T12:39:46.753Z' vendor: Red Hat product: Red Hat Enterprise Linux AppStream (v. 9) affected: - enterprise_linux 6 - openshift_container_platform 4 - enterprise_linux_server_v_7_els - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_eus_v_10_0 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_v_8 - enterprise_linux_baseos_aus_v_8_4 - enterprise_linux_baseos_eus_extension_v_8_4 - enterprise_linux_baseos_aus_v_8_6 - enterprise_linux_baseos_eus_extension_v_8_6 - enterprise_linux_baseos_e4s_v_8_8 - enterprise_linux_baseos_tus_v_8_8 - enterprise_linux_baseos_e4s_v_9_2 - enterprise_linux_baseos_e4s_v_9_4 - enterprise_linux_baseos_eus_v_9_6 - enterprise_linux_baseos_v_9 - hardened_images patched: - enterprise_linux_server_v_7_els - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_eus_v_10_0 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_v_8 - enterprise_linux_baseos_aus_v_8_4 - enterprise_linux_baseos_eus_extension_v_8_4 - enterprise_linux_baseos_aus_v_8_6 - enterprise_linux_baseos_eus_extension_v_8_6 - enterprise_linux_baseos_e4s_v_8_8 - enterprise_linux_baseos_tus_v_8_8 - enterprise_linux_baseos_e4s_v_9_2 - enterprise_linux_baseos_e4s_v_9_4 - enterprise_linux_baseos_eus_v_9_6 - enterprise_linux_baseos_v_9 - hardened_images scores: nvd: 5.9 vendor: 4.8 --- ## Overview Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:61227** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61227) - **RHSA-2026:61229** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61229) - **RHSA-2026:59379** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59379) - **RHSA-2026:61226** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61226) - **RHSA-2026:61228** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61228) - **RHSA-2026:61230** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61230) - **RHSA-2026:60224** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60224) - **RHSA-2026:64815** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64815) - **RHSA-2026:56131** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56131) - **RHSA-2026:61224** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61224) - **RHSA-2026:61223** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61223) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54411.json)