A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Dell Powerstore Dsa2025429 | — | Upgrade Dell PowerStoreOS to the latest version | Dec 3, 2025 | Dec 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Dell Powerstore Dsa2026115 | — | Upgrade Dell PowerStoreOS to the latest version | Jun 16, 2026 | Feb 24, 2026 |
| Huawei Euleros 2_0_sp9 | — | Upgrade pam | Jan 8, 2026 | Jan 7, 2026 |
| Suse | — | Upgrade gdm-langUpgrade pam-develUpgrade pam_pkcs11Upgrade pamUpgrade gdmUpgrade typelib-1_0-Gdm-1_0Upgrade pam-32bitUpgrade pam-devel-32bitUpgrade gdm-develUpgrade pam_pkcs11-devel-docUpgrade libgdm1Upgrade pam-configUpgrade gdmflexiserverUpgrade pam-extra-32bitUpgrade pam-docUpgrade gdm-systemdUpgrade gdm-schemaUpgrade pam_pkcs11-32bitUpgrade pam-extraUpgrade gdm-branding-upstream | Jun 20, 2025 | Jun 18, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub