PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54411 Linux-PAM CVE debrief

CVE-2026-54411 is a MEDIUM severity vulnerability in Linux-PAM, allowing a local or network-adjacent attacker to recover plaintext passwords by measuring timing differences in the pam_userdb module. The vulnerability is caused by an observable timing discrepancy in the plaintext-password comparison path.

Vendor
Linux-PAM
Product
Unknown
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-14
Original CVE updated
2026-08-10
Advisory published
2026-06-14
Advisory updated
2026-08-10

Who should care

Administrators and users of Linux-PAM, particularly those using pam_userdb with crypt=none, unrecognized crypt methods, or without a crypt= argument.

Technical summary

The pam_userdb module in Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in its plaintext-password comparison path. This allows an attacker to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, leaking the password length and individual prefix bytes.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update Linux-PAM to a version that fixes the vulnerability.
  • Configure pam_userdb with a secure crypt method.
  • Use a secure authentication mechanism to prevent exploitation.

Evidence notes

The vulnerability is confirmed by the CVE record and NVD detail pages. [resourceLinkAnnotations:cve-org,nvd]

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54411 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54411

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54411 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54411

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://cwe.mitre.org/data/definitions/208.html

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

  • Source reference

    Unverified legacy reference

    URL: https://github.com/linux-pam/linux-pam

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

  • Source reference

    Unverified legacy reference

    URL: https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

  • Source reference

    Unverified legacy reference

    URL: https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.