Is CVE-2025-6020 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-6020 being exploited in the wild.

How severe is CVE-2025-6020?

High severity, with a CVSS score of 7.8, published 17 June 2025.

Is there a fix for CVE-2025-6020?

A patch was published on 2025-07-01: Red Hat released security updates for RHEL 8 and 9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-6020 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2025-6020?

Check whether you run Debian Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-6020: Linux-PAM privilege escalation in pam_namespace module

CVE-2025-6020 · Severity: high · CVSS 7.8 · Published 2025-06-17

A security vulnerability has been identified in a core Linux component responsible for managing user authentication and system access. This flaw allows a person who already has a standard user account on a system to gain full administrative (root) control. By exploiting how the system handles file paths, an attacker can bypass security restrictions, potentially leading to a complete takeover of the affected server or workstation.

Technologies: Debian Linux. Vendors: Debian.

Quick answers

Is CVE-2025-6020 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-6020 being exploited in the wild.
How severe is CVE-2025-6020?: High severity, with a CVSS score of 7.8, published 17 June 2025.
Which products and versions are affected?: Debian Linux LTS.
Is there a fix for CVE-2025-6020?: A patch was published on 2025-07-01: Red Hat released security updates for RHEL 8 and 9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-6020 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2025-6020?: Check whether you run Debian Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A flaw was discovered in the pam_namespace module of linux-pam, which is responsible for setting up polyinstantiated directories for user sessions. The module fails to properly protect against user-controlled paths, leading to a directory traversal vulnerability (CWE-22). A local attacker with low privileges can exploit this through a combination of multiple symlink attacks and race conditions during the namespace setup process. Successful exploitation allows the attacker to manipulate files outside of their restricted environment and elevate their privileges to root. Patches have been released by major distributions including Red Hat and Debian.

Affected products

Linux-PAM PAM (Pluggable Authentication Modules) Versions prior to 1.6.1
Red Hat Enterprise Linux 8, 9
Debian Debian Linux LTS

Timeline

2025-06-17: disclosed: Initial disclosure on oss-security mailing list
2025-06-17: advisory: NVD record published
2025-07-01: patched: Red Hat released security updates for RHEL 8 and 9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.