PT-2025-33007 · Linux Pam+4 · Linux-Pam+4
Published
2025-08-13
·
Updated
2026-05-10
·
CVE-2025-8941
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
linux-pam (affected versions not specified)
Description
The Pluggable Authentication Modules (PAM) framework contains a flaw in the
pam namespace module. This module improperly handles user-controlled paths, potentially allowing local users to exploit symlink attacks and race conditions to gain root privileges. A proof-of-concept (PoC) exploit has been released for CVE-2025-8941, indicating a high severity and potential for rapid weaponization. The vulnerability stems from the core of Linux operating systems and affects multiple distributions, including Ubuntu, Fedora, and Red Hat Enterprise Linux. The pam namespace module is susceptible to exploitation through the manipulation of paths, leading to privilege escalation.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
LPE
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Centos
Red Hat
Rocky Linux
Linux-Pam