Bug 2442570 (CVE-2026-3184)

Summary: CVE-2026-3184 util-linux: util-linux: Access control bypass due to improper hostname canonicalization
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: adudiak, crizzo, gtanzill, jbuscemi, jmitchel, kaycoth, kshier, pbohmill, stcannon, teagle, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-02-25 07:56:42 UTC 
Summary:
Improper hostname canonicalization in util-linux login(1) when invoked with -h can modify the supplied remote hostname before setting PAM_RHOST, potentially allowing bypass of host-based PAM access control rules (e.g., pam_access) that rely on fully qualified domain names.

Requirements to exploit:
An attacker must be able to access a remote login pathway that invokes login(1) with the -h <remotehost> option (e.g., telnet/rlogin-style daemons or custom wrappers). The target system must use PAM modules relying on PAM_RHOST for authorization decisions (such as pam_access) and have rules that distinguish between FQDNs and short hostnames. The local system hostname must share the same domain suffix as the attacker-supplied hostname.