A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pam-docsUpgrade pam-develUpgrade pam | Sep 4, 2025 | Sep 3, 2025 |
| Amazon Linux Ami 2 | — | Upgrade pamUpgrade pam-develUpgrade pam-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade pam-docsUpgrade pam-debuginfoUpgrade pam-develUpgrade pamUpgrade pam-debugsource | Nov 11, 2025 | Aug 13, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade pam | Oct 14, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade pamUpgrade pam-hsm | Nov 21, 2025 | Oct 10, 2025 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Dec 15, 2025 |
| Oracle_linux | — | Upgrade pam-docsUpgrade pamUpgrade pam-devel | Sep 5, 2025 | Aug 13, 2025 |
| Redhat_linux | — | Upgrade pam-develUpgrade pam-debugsourceUpgrade pamUpgrade pam-docsUpgrade pam-debuginfo | Sep 2, 2025 | Aug 13, 2025 |
| Rocky_linux | — | Upgrade pam-debuginfoUpgrade pam-debugsourceUpgrade pamUpgrade pam-docsUpgrade pam-devel | Feb 5, 2026 | Oct 10, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub