CVE-2026-54411: Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison
Deferred
AliasesMGASA-2026-0461SUSE-SU-2026:22599-1SUSE-SU-2026:22639-1SUSE-SU-2026:22807-1SUSE-SU-2026:22896-1SUSE-SU-2026:3162-1SUSE-SU-2026:3163-1RHSA-2026:35016RHSA-2026:56131RHSA-2026:59379RHSA-2026:60224RHSA-2026:61223RHSA-2026:61224RHSA-2026:61225RHSA-2026:61226RHSA-2026:61227RHSA-2026:61228RHSA-2026:61229RHSA-2026:61230RHSA-2026:64815RHSA-2026:7553UBUNTU-CVE-2026-54411USN-8601-1DEBIAN-CVE-2026-54411CGA-6xpv-g74w-9xwfCGA-jvfq-ppr4-246fopenSUSE-SU-2026:11201-1openSUSE-SU-2026:21320-1
Published 14-06-2026Last modified 10-08-2026
Vulnerability summary
CVE-2026-54411 is a medium (CVSS 6.9) Observable Timing Discrepancy vulnerability in linux-pam. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 25.1% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 6.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
6.9/10
010
Medium · v4.0 (CVE.org)EPSS score
0.32%
0%100%
Low · -0.18 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 14-06-2026PublishedVulnerability first disclosed.
- 10-08-2026Last modifiedVulnerability information updated.
Description
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.
CVSS metrics
10 scores · 7 sources · 2 versionsMedium 6.9Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:DSources6 sources · 6.9–8.2
- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:DDiffers
- OSV · DebianEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:XDiffers
- OSV · WolfiEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:DDiffers
- OSV · ChainguardEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:DDiffers
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X
Medium 5.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSources4 sources · 4.8–5.9
- OSV · Red hatEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
25%
Versus all other CVEs
30-day change
Decrease -0.18 pp
From 0.50% on 05-10-2026
05-10-202604-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse14 products
- pam-full-src&distro=SUSE Linux Enterprise Server 16.0< 1.7.1-160000.5.1
- pam-full-src&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 1.7.1-160000.5.1
- pam-full-src&distro=SUSE Linux Micro 6.2< 1.7.1-160000.5.1
- pam&distro=SUSE Linux Enterprise Micro 5.3< 1.3.0-150000.6.89.1
- pam&distro=SUSE Linux Enterprise Micro 5.4< 1.3.0-150000.6.89.1
Redhat8 products
- pam< 0:1.7.2-2.2.hum1 | < 0:1.3.1-40.el8_10 | < 0:1.6.1-9.el10_2.1 | < 0:1.5.1-27.el9_8.1 | < 0:1.3.1-16.el8_6.4 | < 0:1.3.1-14.el8_4.3 | < 0:1.3.1-26.el8_8.3 | < 0:1.5.1-15.el9_2.3 | < 0:1.1.8-23.el7_9.3 | < 0:1.5.1-24.el9_4.2 | < 0:1.6.1-8.el10_0.1 | < 0:1.5.1-26.el9_6.1 | < 0:1.5.1-28.el9_8.1 | < 0:1.7.2-1.1.hum1
- pam-debuginfo< 0:1.3.1-40.el8_10 | < 0:1.6.1-9.el10_2.1 | < 0:1.5.1-27.el9_8.1 | < 0:1.3.1-16.el8_6.4 | < 0:1.3.1-14.el8_4.3 | < 0:1.3.1-26.el8_8.3 | < 0:1.5.1-15.el9_2.3 | < 0:1.1.8-23.el7_9.3 | < 0:1.5.1-24.el9_4.2 | < 0:1.6.1-8.el10_0.1 | < 0:1.5.1-26.el9_6.1 | < 0:1.5.1-28.el9_8.1
- pam-debugsource< 0:1.3.1-40.el8_10 | < 0:1.6.1-9.el10_2.1 | < 0:1.5.1-27.el9_8.1 | < 0:1.3.1-16.el8_6.4 | < 0:1.3.1-14.el8_4.3 | < 0:1.3.1-26.el8_8.3 | < 0:1.5.1-15.el9_2.3 | < 0:1.5.1-24.el9_4.2 | < 0:1.6.1-8.el10_0.1 | < 0:1.5.1-26.el9_6.1 | < 0:1.5.1-28.el9_8.1
- pam-devel< 0:1.7.2-2.2.hum1 | < 0:1.3.1-40.el8_10 | < 0:1.6.1-9.el10_2.1 | < 0:1.5.1-27.el9_8.1 | < 0:1.3.1-16.el8_6.4 | < 0:1.3.1-14.el8_4.3 | < 0:1.3.1-26.el8_8.3 | < 0:1.5.1-15.el9_2.3 | < 0:1.1.8-23.el7_9.3 | < 0:1.5.1-24.el9_4.2 | < 0:1.6.1-8.el10_0.1 | < 0:1.5.1-26.el9_6.1 | < 0:1.5.1-28.el9_8.1 | < 0:1.7.2-1.1.hum1
- pam-doc< 0:1.7.2-2.2.hum1 | < 0:1.7.2-1.1.hum1
Opensuse3 products
- pam-full-src&distro=openSUSE Leap 16.0< 1.7.1-160000.5.1
- pam&distro=openSUSE Leap 16.0< 1.7.1-160000.5.1
- pam&distro=openSUSE Tumbleweed< 1.7.2+git12-2.1
Chainguard1 product
- linux-pamAll versions (No fix recorded)
Debian1 product
- pamAll versions (No fix recorded)
Linux-pam1 product
- linux-pam≤ 1.7.2
Mageia1 product
- pam< 1.7.1-2.1.mga10
Ubuntu1 product
- pamAll versions (No fix recorded) | < 1.4.0-11ubuntu2.7 | < 1.5.3-5ubuntu5.6 | < 1.7.0-5ubuntu3.1
Wolfi1 product
- linux-pamAll versions (No fix recorded)
9 vendors · 31 products
References
54 linksShow all 54 references
- images.redhat.comARTICLE
