CVE-2026-3184: kernel util-linux Authentication Bypass by Alternate Name

Vulnerability summary

CVE-2026-3184 is a medium (CVSS 5.3) Authentication Bypass by Alternate Name vulnerability in kernel util-linux. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.4% of scored vulnerabilities.

Timeline

1. 03-04-2026
   PublishedVulnerability first disclosed.
2. 31-08-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.

• CWE-289Authentication Bypass by Alternate NameThe product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.