Bug 2488766 (CVE-2026-54411) - CVE-2026-54411 linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module
Summary: CVE-2026-54411 linux-pam: Plaintext password recovery via timing discrepancy ...
Keywords:
Status: NEW
Alias: CVE-2026-54411
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2496416
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-14 18:01 UTC by OSIDB Bzimport
Modified: 2026-08-31 13:30 UTC (History)
22 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:56131 0 None None None 2026-08-18 12:22:25 UTC
Red Hat Product Errata RHSA-2026:59379 0 None None None 2026-08-25 12:36:53 UTC
Red Hat Product Errata RHSA-2026:60224 0 None None None 2026-08-26 11:49:55 UTC
Red Hat Product Errata RHSA-2026:61223 0 None None None 2026-08-31 01:04:06 UTC
Red Hat Product Errata RHSA-2026:61224 0 None None None 2026-08-31 00:53:55 UTC
Red Hat Product Errata RHSA-2026:61225 0 None None None 2026-08-31 01:08:08 UTC
Red Hat Product Errata RHSA-2026:61226 0 None None None 2026-08-31 01:08:18 UTC
Red Hat Product Errata RHSA-2026:61227 0 None None None 2026-08-31 01:08:26 UTC
Red Hat Product Errata RHSA-2026:61228 0 None None None 2026-08-31 01:28:28 UTC
Red Hat Product Errata RHSA-2026:61229 0 None None None 2026-08-31 01:01:23 UTC
Red Hat Product Errata RHSA-2026:61230 0 None None None 2026-08-31 02:28:07 UTC

Description OSIDB Bzimport 2026-06-14 18:01:18 UTC 
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.
Comment 4 errata-xmlrpc 2026-08-18 12:22:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:56131 https://access.redhat.com/errata/RHSA-2026:56131
Comment 5 errata-xmlrpc 2026-08-25 12:36:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:59379 https://access.redhat.com/errata/RHSA-2026:59379
Comment 6 errata-xmlrpc 2026-08-26 11:49:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:60224 https://access.redhat.com/errata/RHSA-2026:60224
Comment 7 errata-xmlrpc 2026-08-31 00:53:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:61224 https://access.redhat.com/errata/RHSA-2026:61224
Comment 8 errata-xmlrpc 2026-08-31 01:01:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:61229 https://access.redhat.com/errata/RHSA-2026:61229
Comment 9 errata-xmlrpc 2026-08-31 01:01:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:61229 https://access.redhat.com/errata/RHSA-2026:61229
Comment 10 errata-xmlrpc 2026-08-31 01:04:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:61223 https://access.redhat.com/errata/RHSA-2026:61223
Comment 11 errata-xmlrpc 2026-08-31 01:08:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:61225 https://access.redhat.com/errata/RHSA-2026:61225
Comment 12 errata-xmlrpc 2026-08-31 01:08:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:61226 https://access.redhat.com/errata/RHSA-2026:61226
Comment 13 errata-xmlrpc 2026-08-31 01:08:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:61227 https://access.redhat.com/errata/RHSA-2026:61227
Comment 14 errata-xmlrpc 2026-08-31 01:28:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:61228 https://access.redhat.com/errata/RHSA-2026:61228
Comment 15 errata-xmlrpc 2026-08-31 02:28:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:61230 https://access.redhat.com/errata/RHSA-2026:61230
Note You need to log in before you can comment on or make changes to this bug.