CoreCVE
Back

HIGH

Linux-pam: incomplete fix for cve-2025-6020

Published Aug 13, 2025

Description

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Affected products

Remediation

Vendor solution

Disable the `pam_namespace` module if it is not essential for your environment, or carefully review and configure it to avoid operating on any directories or paths that can be influenced or controlled by unprivileged users, such as user home directories or world-writable locations like `/tmp`.

Red Hat statement

This vulnerability in pam_namespace is rated Important because it allows a local, unprivileged user to escalate privileges to root by exploiting symlink attacks or race conditions in polyinstantiated directories under their control. Successful exploitation requires only the ability to create and manipulate filesystem paths in such directories, without the need for special capabilities or kernel-level vulnerabilities. In multi-user environments—such as shared systems, terminal servers, or certain container deployments, an unprotected or misconfigured pam_namespace configuration can serve as a single point of compromise. Privilege escalation flaws of this nature may also be chained with other vulnerabilities to maintain persistence or evade detection, further increasing the overall impact.

Red Hat mitigation

Disable the `pam_namespace` module if it is not essential for your environment, or carefully review and configure it to avoid operating on any directories or paths that can be influenced or controlled by unprivileged users, such as user home directories or world-writable locations like `/tmp`.

Weaknesses (1)

CWE-22

Path Traversal

References (21)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Aug 13, 2025
Updated Feb 26, 2026
Reserved Aug 13, 2025
Link CVE-2025-8941
CISA Vulnrichment
Updated Aug 13, 2025
NVD
Status Deferred
Modified Jun 17, 2026
Link CVE-2025-8941
Red Hat
Severity Important
Public date Aug 13, 2025
Links CVE-2025-8941 - Bugzilla