CVE-2025-6020

Linux-pam: linux-pam directory traversal

State: Published
Severity: 7.8 High
Published: Jun 17, 2025
Updated: Oct 12, 2026
Reserved: Jun 11, 2025

Description

A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	redhat

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
linux-pam	before 1.7.1Affected
Red Hat Enterprise Linux 10Red Hat	0:1.6.1-8.el10 and laterNot affected
Red Hat Enterprise Linux 10.0 Extended Update SupportRed Hat	0:1.6.1-8.el10_0 and laterNot affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat	0:1.1.8-23.el7_9.1 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	0:1.3.1-37.el8_10 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	0:1.3.1-38.el8_10 and laterNot affected
Red Hat Enterprise Linux 8.2 Advanced Update SupportRed Hat	0:1.3.1-8.el8_2.1 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat	0:1.3.1-14.el8_4.1 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat	0:1.3.1-16.el8_6.2 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat	0:1.3.1-16.el8_6.2 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat	0:1.3.1-16.el8_6.2 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat	0:1.3.1-26.el8_8.1 and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat	0:1.3.1-26.el8_8.1 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:1.5.1-26.el9_6 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:1.5.1-25.el9_6 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:1.5.1-26.el9_6 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:1.5.1-25.el9_6 and laterNot affected
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat	0:1.5.1-9.el9_0.2 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat	0:1.5.1-15.el9_2.1 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat	0:1.5.1-24.el9_4 and laterNot affected
Red Hat Web Terminal 1.11 on RHEL 9Red Hat	1.11-19 and laterNot affected
Red Hat Web Terminal 1.11 on RHEL 9Red Hat	1.11-8 and laterNot affected
Red Hat Web Terminal 1.12 on RHEL 9Red Hat	1.12-4 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat	7.13.5-4.1752066672 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat	7.13.5-4.1752065732 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat	7.13.5-4.1752065732 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat	7.13.5-3.1752065737 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat	7.13.5-4.1752065731 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat	7.13.5-25 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat	7.13.5-4.1752065736 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat	7.13.5-2.1752065733 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat	7.13.5-4.1752065755 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat	1.36.0-11 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat	1.36.0-11 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat	1.36.0-11 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat	1.36.0-10 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat	1.36.0-10 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat	1.36.0-4 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat	1.36.0-9 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat	1.36.0-12 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat	1.36.0-18 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat	1.36.0-11 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat	1.36.0-7 and laterNot affected
cert-manager operator for Red Hat OpenShift 1.16Red Hat	v1.16.5-1760515757 and laterNot affected
Compliance Operator 1Red Hat	1.8.0 and laterNot affected
Red Hat Discovery 2Red Hat	2.0.0-1752592913 and laterNot affected
Red Hat Discovery 2Red Hat	2.2.1-1758555934 and laterNot affected
Red Hat Insights proxy 1.5Red Hat	1.5.7-1759331989 and laterNot affected
Red Hat OpenShift distributed tracing 3.6.0Red Hat	rhosdt-3.6-1752046452 and laterNot affected
Red Hat OpenShift distributed tracing 3.6.0Red Hat	rhosdt-3.6-1752046437 and laterNot affected
Red Hat OpenShift distributed tracing 3.6.0Red Hat	rhosdt-3.6-1752046439 and laterNot affected
Red Hat OpenShift distributed tracing 3.6.0Red Hat	rhosdt-3.6-1752070865 and laterNot affected
Red Hat OpenShift distributed tracing 3.6.0Red Hat	rhosdt-3.6-1752070873 and laterNot affected
Red Hat OpenShift distributed tracing 3.6.0Red Hat	rhosdt-3.6-1751993590 and laterNot affected
Red Hat OpenShift distributed tracing 3.6.0Red Hat	rhosdt-3.6-1752070827 and laterNot affected
Red Hat OpenShift distributed tracing 3.6.0Red Hat	rhosdt-3.6-1752070833 and laterNot affected
Red Hat OpenShift distributed tracing 3.6.0Red Hat	rhosdt-3.6-1752070866 and laterNot affected
Red Hat OpenShift sandboxed containers 1.10Red Hat	1.10.2-1757422110 and laterNot affected
Red Hat OpenShift sandboxed containers 1.10Red Hat	1.10.2-1757421804 and laterNot affected
Red Hat OpenShift sandboxed containers 1.10Red Hat	1.10.2-1757421879 and laterNot affected
Red Hat OpenShift sandboxed containers 1.10Red Hat	1.10.2-1757422401 and laterNot affected

References

RHSA-2025:10024vendor-advisory
RHSA-2025:10027vendor-advisory
RHSA-2025:10180vendor-advisory
RHSA-2025:10354vendor-advisory
RHSA-2025:10357vendor-advisory
RHSA-2025:10358vendor-advisory
RHSA-2025:10359vendor-advisory
RHSA-2025:10361vendor-advisory
RHSA-2025:10362vendor-advisory
RHSA-2025:10735vendor-advisory
RHSA-2025:10823vendor-advisory
RHSA-2025:11386vendor-advisory
RHSA-2025:11487vendor-advisory
RHSA-2025:14557vendor-advisory
RHSA-2025:15099vendor-advisory
RHSA-2025:15709vendor-advisory
RHSA-2025:15827vendor-advisory
RHSA-2025:15828vendor-advisory
RHSA-2025:16524vendor-advisory
RHSA-2025:17181vendor-advisory
RHSA-2025:18219vendor-advisory
RHSA-2025:20181vendor-advisory
RHSA-2025:21885vendor-advisory
RHSA-2025:22019vendor-advisory
RHSA-2025:9526vendor-advisory
RHSA-2026:0934vendor-advisory
https://access.redhat.com/security/cve/CVE-2025-6020vdb-entry
RHBZ#2372512issue-tracking
https://github.com/linux-pam/linux-pam/security/advisories/GHSA-f9p8-gjr4-j9gx
http://www.openwall.com/lists/oss-security/2025/06/17/1
https://lists.debian.org/debian-lts-announce/2025/09/msg00021.html
https://cert-portal.siemens.com/productcert/html/ssa-577017.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.