CVE-2025-6020
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A vulnerability was found in the pam_namespace module of linux-pam, where user-controlled paths are not properly protected. A local attacker can exploit symlink attacks and race conditions to escalate privileges to root.
Risk Assessment
The organization faces the risk of a local user gaining full root control over the system, potentially compromising data confidentiality, integrity, and availability.
Recommendation
Immediately update the linux-pam package to a version containing the fix for this vulnerability. Until the update is applied, consider restricting access to the pam_namespace module for unprivileged users.
Other vulnerabilities in linux-pam
See all- CVE-2024-22365Medium
A vulnerability in Linux PAM before version 1.6.0 allows attackers to cause a denial of service by blocking the login process. The issue stems from the lack of the O_DIRECTORY flag in the openat call for the protect_dir function, enabling the use of mkfifo.
- CVE-2026-54411Medium
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path, allowing a local or network-adjacent attacker to recover the plaintext password of a target account by measuring response-timing differences.
Original NVD description (English source)
A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.