Executive brief
Linux-PAM is a core system library used by Linux operating systems to handle user authentication for various services. A security flaw in its database module allows an attacker to guess a user's password by carefully measuring the time the system takes to reject incorrect login attempts. If successfully exploited, this could lead to unauthorized account access and the exposure of sensitive user credentials.
Technical details
A timing side-channel vulnerability (CWE-208) exists in the pam_userdb module of Linux-PAM through version 1.7.2. The vulnerability is located in the plaintext-password comparison logic within modules/pam_userdb/pam_userdb.c, which uses strncmp() or strncasecmp() after a length-equality check. Because these functions return early upon finding a mismatch, an attacker can measure response-timing differences to determine the password length and individual prefix bytes. This vulnerable path is triggered when pam_userdb is configured with 'crypt=none', an unrecognized crypt method, or no crypt argument. Attackers with local or network-adjacent access can exploit this by repeatedly driving authentication attempts through a calling service.
Affected products
- Linux-PAM project Linux-PAM through 1.7.2
Timeline
- 2026-06-14: disclosed: CVE published to NVD dataset
- 2026-06-14: advisory