CVE-2025-6020

Linux-pam: linux-pam directory traversal

View on CVE.org
Published Jun 17, 2025 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

Remediation

Vendor Workaround

Disable the `pam_namespace` module if it is not essential for your environment, or carefully review and configure it to avoid operating on any directories or paths that can be influenced or controlled by unprivileged users, such as user home directories or world-writable locations like `/tmp`.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4306-1 pam security update
EUVD EUVD EUVD-2025-19056 A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.
Ubuntu USN Ubuntu USN USN-7580-1 PAM vulnerability
References
Link Providers
http://www.openwall.com/lists/oss-security/2025/06/17/1 cve-icon
https://access.redhat.com/errata/RHSA-2025:10024 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10027 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10180 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10354 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10357 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10358 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10359 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10361 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10362 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10735 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10823 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:11386 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:11487 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:14557 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:15099 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:15709 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:15827 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:15828 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:16524 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:17181 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:18219 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:20181 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:21885 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:22019 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:9526 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:0934 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2025-6020 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2372512 cve-icon cve-icon
https://cert-portal.siemens.com/productcert/html/ssa-577017.html cve-icon
https://github.com/linux-pam/linux-pam/security/advisories/GHSA-f9p8-gjr4-j9gx cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2025/09/msg00021.html cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-6020 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-6020 cve-icon
History
Type Values Removed Values Added
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos
Type Values Removed Values Added
First Time appeared Redhat rhivos
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Redhat openshift Serverless
CPEs cpe:/a:redhat:openshift_serverless:1.36::el8
Vendors & Products Redhat openshift Serverless
References
Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
CPEs cpe:/o:redhat:enterprise_linux_eus:10.0
Vendors & Products Redhat enterprise Linux Eus
References
Type Values Removed Values Added
First Time appeared Redhat openshift Compliance Operator
CPEs cpe:/a:redhat:openshift_compliance_operator:1::el9
Vendors & Products Redhat openshift Compliance Operator
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.1
References
Type Values Removed Values Added
First Time appeared Redhat insights Proxy
CPEs cpe:/a:redhat:insights_proxy:1.5::el9
Vendors & Products Redhat insights Proxy
References
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Redhat cert Manager
CPEs cpe:/a:redhat:cert_manager:1.16::el9
Vendors & Products Redhat cert Manager
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10
Type Values Removed Values Added
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos
Type Values Removed Values Added
First Time appeared Redhat rhivos
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:webterminal:1.12::el9
References
Type Values Removed Values Added
First Time appeared Redhat webterminal
CPEs cpe:/a:redhat:webterminal:1.11::el9
Vendors & Products Redhat webterminal
References
Type Values Removed Values Added
First Time appeared Redhat confidential Compute Attestation
CPEs cpe:/a:redhat:confidential_compute_attestation:1.10::el9
Vendors & Products Redhat confidential Compute Attestation
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Redhat discovery
CPEs cpe:/a:redhat:discovery:2::el9
Vendors & Products Redhat discovery
References
Type Values Removed Values Added
First Time appeared Redhat rhosemc
CPEs cpe:/a:redhat:rhosemc:1.0::el8
Vendors & Products Redhat rhosemc
References
Type Values Removed Values Added
Metrics epss

{'score': 0.00023}

 epss

{'score': 0.00018}
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Redhat openshift Distributed Tracing
CPEs cpe:/a:redhat:openshift_distributed_tracing:3.6::el8
Vendors & Products Redhat openshift Distributed Tracing
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.0
cpe:/o:redhat:rhel_aus:8.2
cpe:/o:redhat:rhel_aus:8.4
cpe:/o:redhat:rhel_aus:8.6
cpe:/o:redhat:rhel_e4s:8.6
cpe:/o:redhat:rhel_e4s:8.8
cpe:/o:redhat:rhel_tus:8.6
cpe:/o:redhat:rhel_tus:8.8
Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel Els
Redhat rhel Tus
CPEs cpe:/o:redhat:enterprise_linux:7 cpe:/a:redhat:rhel_e4s:9.0::appstream
cpe:/o:redhat:rhel_aus:8.2::baseos
cpe:/o:redhat:rhel_aus:8.4::baseos
cpe:/o:redhat:rhel_aus:8.6::baseos
cpe:/o:redhat:rhel_e4s:8.6::baseos
cpe:/o:redhat:rhel_e4s:8.8::baseos
cpe:/o:redhat:rhel_e4s:9.0::baseos
cpe:/o:redhat:rhel_els:7
cpe:/o:redhat:rhel_tus:8.6::baseos
cpe:/o:redhat:rhel_tus:8.8::baseos
Vendors & Products Redhat rhel Aus
Redhat rhel Els
Redhat rhel Tus
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.2
Type Values Removed Values Added
First Time appeared Redhat rhel E4s
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/o:redhat:rhel_e4s:9.2::baseos
Vendors & Products Redhat rhel E4s
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_eus:9.4
cpe:/o:redhat:enterprise_linux:8
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:8::baseos
References
Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.4::appstream
cpe:/o:redhat:rhel_eus:9.4::baseos
Vendors & Products Redhat rhel Eus
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/o:redhat:enterprise_linux:9
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
References
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.
Title Linux-pam: linux-pam directory traversal
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-22
CPEs cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Earlier changes (33)
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 6, 2026, 1:00 AM
Reserved
Jun 11, 2025, 10:38 PM

View source JSON

Updated
Nov 3, 2025, 6:13 PM

JSON

Status
Deferred
Published
Jun 17, 2025, 1:15 PM
Modified
Nov 6, 2026, 1:17 AM

View source JSON

Severity
Important
Public date
Jun 17, 2025, 12:00 AM

View source Bugzilla JSON

Updated
Apr 20, 2026, 4:30 PM

JSON