Skip to content

CVE-2025-8941

Linux-pam: incomplete fix for cve-2025-6020

7.8 HighFix available

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.28%Up 0.3 points since Aug 14, 2025

What each source reports

CVE List Score used 7.8

Linux-pam: incomplete fix for cve-2025-6020

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Record: CVE-2025-8941
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2025-24657 7.8

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Record: EUVD-2025-24657
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-hqqx-rjqh-53c2 7.8

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled...

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Record: GHSA-hqqx-rjqh-53c2
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

NVD 7.8

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Record: CVE-2025-8941
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-8941 7.8

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Record: DEBIAN-CVE-2025-8941
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:14557 7.8

Red Hat Security Advisory: pam security update

Record: RHSA-2025:14557
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 17 moreShow less

OSVRHSA-2025:15099 7.8

Red Hat Security Advisory: pam security update

Record: RHSA-2025:15099
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:15100 7.8

Red Hat Security Advisory: pam security update

Record: RHSA-2025:15100
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:15101 7.8

Red Hat Security Advisory: pam security update

Record: RHSA-2025:15101
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:15102 7.8

Red Hat Security Advisory: pam security update

Record: RHSA-2025:15102
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:15103 7.8

Red Hat Security Advisory: pam security update

Record: RHSA-2025:15103
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:15104 7.8

Red Hat Security Advisory: pam security update

Record: RHSA-2025:15104
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:15105 7.8

Red Hat Security Advisory: pam security update

Record: RHSA-2025:15105
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:15106 7.8

Red Hat Security Advisory: pam security update

Record: RHSA-2025:15106
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:15107 7.8

Red Hat Security Advisory: pam security update

Record: RHSA-2025:15107
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2025:14557 7.8

Important: pam security update

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2025:14557
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2025:15099 7.8

Important: pam security update

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

linux-pam: Linux-pam directory Traversal (CVE-2025-6020)
linux-pam: Incomplete fix for CVE-2025-6020 (CVE-2025-8941)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2025:15099
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-8941 7.8

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Record: UBUNTU-CVE-2025-8941
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2025:14557 No score

Important: pam security update

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2025:14557
Updated: 2026-11-02

OSVALSA-2025:15099 No score

Important: pam security update

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

linux-pam: Linux-pam directory Traversal (CVE-2025-6020)
linux-pam: Incomplete fix for CVE-2025-6020 (CVE-2025-8941)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2025:15099
Updated: 2026-11-02

OSVCLSA-2025-1767001153 No score

pam: Fix of CVE-2025-8941

CVE-2025-8941: fix additiinally potential privilege escalationvia multiple symlink attacks and race conditions

Record: CLSA-2025-1767001153
Updated: 2026-11-02

OSV No score

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Record: CVE-2025-8941
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2025-8941 No score

CVE-2025-8941 in pam - Patched by Root

Root has patched CVE-2025-8941 in the pam package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2025-8941
Updated: 2026-11-02

Affected products

Show 9 moreShow less

Affected packages

Affected packages
Package	Affected	Fixed
`pam` AlmaLinux:8 From an advisory covering 2 CVEs	before 1.3.1-38.el8_10	1.3.1-38.el8_10
`pam-devel` AlmaLinux:8 From an advisory covering 2 CVEs	before 1.3.1-38.el8_10	1.3.1-38.el8_10
`pam` AlmaLinux:9 From an advisory covering 2 CVEs	before 1.5.1-26.el9_6	1.5.1-26.el9_6
`pam-devel` AlmaLinux:9 From an advisory covering 2 CVEs	before 1.5.1-26.el9_6	1.5.1-26.el9_6
`pam-docs` AlmaLinux:9 From an advisory covering 2 CVEs	before 1.5.1-26.el9_6	1.5.1-26.el9_6
`pam` TuxCare:AlmaLinux:9.2	before 1.5.1-14.el9.tuxcare.els4	1.5.1-14.el9.tuxcare.els4
`pam-devel` TuxCare:AlmaLinux:9.2	before 1.5.1-14.el9.tuxcare.els4	1.5.1-14.el9.tuxcare.els4
`pam-docs` TuxCare:AlmaLinux:9.2	before 1.5.1-14.el9.tuxcare.els4	1.5.1-14.el9.tuxcare.els4
`pam` Debian:12	All versions, plus listed versions 1.5.2-61.5.2-6+deb12u11.5.2-6+deb12u21.5.2-71.5.2-8 Show 19 moreShow less 1.5.2-91.5.2-9.11.5.3-11.5.3-21.5.3-31.5.3-41.5.3-51.5.3-61.5.3-6+hurd.11.5.3-71.7.0-11.7.0-21.7.0-2+hurd.11.7.0-31.7.0-41.7.0-51.7.0-61.7.0-71.7.0-8	None known
`pam` Debian:13	All versions, plus listed versions 1.7.0-51.7.0-61.7.0-71.7.0-8	None known

Show 72 moreShow less

Affected packages
Package	Affected	Fixed
`pam` Debian:14	All versions, plus listed versions 1.7.0-51.7.0-61.7.0-71.7.0-8	None known
`pam` Red Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs	before 0:1.3.1-38.el8_10	0:1.3.1-38.el8_10
`pam-debuginfo` Red Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs	before 0:1.3.1-38.el8_10	0:1.3.1-38.el8_10
`pam-debugsource` Red Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs	before 0:1.3.1-38.el8_10	0:1.3.1-38.el8_10
`pam-devel` Red Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs	before 0:1.3.1-38.el8_10	0:1.3.1-38.el8_10
`pam-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.5.1-26.el9_6	0:1.5.1-26.el9_6
`pam-debugsource` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.5.1-26.el9_6	0:1.5.1-26.el9_6
`pam-devel` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.5.1-26.el9_6	0:1.5.1-26.el9_6
`pam-docs` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.5.1-26.el9_6	0:1.5.1-26.el9_6
`pam` Red Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs	before 0:1.5.1-26.el9_6	0:1.5.1-26.el9_6
`pam-debuginfo` Red Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs	before 0:1.5.1-26.el9_6	0:1.5.1-26.el9_6
`pam-debugsource` Red Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs	before 0:1.5.1-26.el9_6	0:1.5.1-26.el9_6
`pam-debuginfo` Red Hat:rhel_e4s:9.0::appstream	before 0:1.5.1-9.el9_0.3	0:1.5.1-9.el9_0.3
`pam-debugsource` Red Hat:rhel_e4s:9.0::appstream	before 0:1.5.1-9.el9_0.3	0:1.5.1-9.el9_0.3
`pam-devel` Red Hat:rhel_e4s:9.0::appstream	before 0:1.5.1-9.el9_0.3	0:1.5.1-9.el9_0.3
`pam-docs` Red Hat:rhel_e4s:9.0::appstream	before 0:1.5.1-9.el9_0.3	0:1.5.1-9.el9_0.3
`pam` Red Hat:rhel_e4s:9.0::baseos	before 0:1.5.1-9.el9_0.3	0:1.5.1-9.el9_0.3
`pam-debuginfo` Red Hat:rhel_e4s:9.0::baseos	before 0:1.5.1-9.el9_0.3	0:1.5.1-9.el9_0.3
`pam-debugsource` Red Hat:rhel_e4s:9.0::baseos	before 0:1.5.1-9.el9_0.3	0:1.5.1-9.el9_0.3
`pam-debuginfo` Red Hat:rhel_e4s:9.2::appstream	before 0:1.5.1-15.el9_2.2	0:1.5.1-15.el9_2.2
`pam-debugsource` Red Hat:rhel_e4s:9.2::appstream	before 0:1.5.1-15.el9_2.2	0:1.5.1-15.el9_2.2
`pam-devel` Red Hat:rhel_e4s:9.2::appstream	before 0:1.5.1-15.el9_2.2	0:1.5.1-15.el9_2.2
`pam-docs` Red Hat:rhel_e4s:9.2::appstream	before 0:1.5.1-15.el9_2.2	0:1.5.1-15.el9_2.2
`pam` Red Hat:rhel_e4s:9.2::baseos	before 0:1.5.1-15.el9_2.2	0:1.5.1-15.el9_2.2
`pam-debuginfo` Red Hat:rhel_e4s:9.2::baseos	before 0:1.5.1-15.el9_2.2	0:1.5.1-15.el9_2.2
`pam-debugsource` Red Hat:rhel_e4s:9.2::baseos	before 0:1.5.1-15.el9_2.2	0:1.5.1-15.el9_2.2
`pam-debuginfo` Red Hat:rhel_eus:9.4::appstream	before 0:1.5.1-24.el9_4.1	0:1.5.1-24.el9_4.1
`pam-debugsource` Red Hat:rhel_eus:9.4::appstream	before 0:1.5.1-24.el9_4.1	0:1.5.1-24.el9_4.1
`pam-devel` Red Hat:rhel_eus:9.4::appstream	before 0:1.5.1-24.el9_4.1	0:1.5.1-24.el9_4.1
`pam-docs` Red Hat:rhel_eus:9.4::appstream	before 0:1.5.1-24.el9_4.1	0:1.5.1-24.el9_4.1
`pam` Red Hat:rhel_eus:9.4::baseos	before 0:1.5.1-24.el9_4.1	0:1.5.1-24.el9_4.1
`pam-debuginfo` Red Hat:rhel_eus:9.4::baseos	before 0:1.5.1-24.el9_4.1	0:1.5.1-24.el9_4.1
`pam-debugsource` Red Hat:rhel_eus:9.4::baseos	before 0:1.5.1-24.el9_4.1	0:1.5.1-24.el9_4.1
`pam` Red Hat:rhel_e4s:8.8::baseos	before 0:1.3.1-26.el8_8.2	0:1.3.1-26.el8_8.2
`pam-debuginfo` Red Hat:rhel_e4s:8.8::baseos	before 0:1.3.1-26.el8_8.2	0:1.3.1-26.el8_8.2
`pam-debugsource` Red Hat:rhel_e4s:8.8::baseos	before 0:1.3.1-26.el8_8.2	0:1.3.1-26.el8_8.2
`pam-devel` Red Hat:rhel_e4s:8.8::baseos	before 0:1.3.1-26.el8_8.2	0:1.3.1-26.el8_8.2
`pam` Red Hat:rhel_tus:8.8::baseos	before 0:1.3.1-26.el8_8.2	0:1.3.1-26.el8_8.2
`pam-debuginfo` Red Hat:rhel_tus:8.8::baseos	before 0:1.3.1-26.el8_8.2	0:1.3.1-26.el8_8.2
`pam-debugsource` Red Hat:rhel_tus:8.8::baseos	before 0:1.3.1-26.el8_8.2	0:1.3.1-26.el8_8.2
`pam-devel` Red Hat:rhel_tus:8.8::baseos	before 0:1.3.1-26.el8_8.2	0:1.3.1-26.el8_8.2
`pam` Red Hat:rhel_aus:8.4::baseos	before 0:1.3.1-14.el8_4.2	0:1.3.1-14.el8_4.2
`pam-debuginfo` Red Hat:rhel_aus:8.4::baseos	before 0:1.3.1-14.el8_4.2	0:1.3.1-14.el8_4.2
`pam-debugsource` Red Hat:rhel_aus:8.4::baseos	before 0:1.3.1-14.el8_4.2	0:1.3.1-14.el8_4.2
`pam-devel` Red Hat:rhel_aus:8.4::baseos	before 0:1.3.1-14.el8_4.2	0:1.3.1-14.el8_4.2
`pam` Red Hat:rhel_eus_long_life:8.4::baseos	before 0:1.3.1-14.el8_4.2	0:1.3.1-14.el8_4.2
`pam-debuginfo` Red Hat:rhel_eus_long_life:8.4::baseos	before 0:1.3.1-14.el8_4.2	0:1.3.1-14.el8_4.2
`pam-debugsource` Red Hat:rhel_eus_long_life:8.4::baseos	before 0:1.3.1-14.el8_4.2	0:1.3.1-14.el8_4.2
`pam-devel` Red Hat:rhel_eus_long_life:8.4::baseos	before 0:1.3.1-14.el8_4.2	0:1.3.1-14.el8_4.2
`pam` Red Hat:rhel_aus:8.6::baseos	before 0:1.3.1-16.el8_6.3	0:1.3.1-16.el8_6.3
`pam-debuginfo` Red Hat:rhel_aus:8.6::baseos	before 0:1.3.1-16.el8_6.3	0:1.3.1-16.el8_6.3
`pam-debugsource` Red Hat:rhel_aus:8.6::baseos	before 0:1.3.1-16.el8_6.3	0:1.3.1-16.el8_6.3
`pam-devel` Red Hat:rhel_aus:8.6::baseos	before 0:1.3.1-16.el8_6.3	0:1.3.1-16.el8_6.3
`pam` Red Hat:rhel_e4s:8.6::baseos	before 0:1.3.1-16.el8_6.3	0:1.3.1-16.el8_6.3
`pam-debuginfo` Red Hat:rhel_e4s:8.6::baseos	before 0:1.3.1-16.el8_6.3	0:1.3.1-16.el8_6.3
`pam-debugsource` Red Hat:rhel_e4s:8.6::baseos	before 0:1.3.1-16.el8_6.3	0:1.3.1-16.el8_6.3
`pam-devel` Red Hat:rhel_e4s:8.6::baseos	before 0:1.3.1-16.el8_6.3	0:1.3.1-16.el8_6.3
`pam` Red Hat:rhel_tus:8.6::baseos	before 0:1.3.1-16.el8_6.3	0:1.3.1-16.el8_6.3
`pam-debuginfo` Red Hat:rhel_tus:8.6::baseos	before 0:1.3.1-16.el8_6.3	0:1.3.1-16.el8_6.3
`pam-debugsource` Red Hat:rhel_tus:8.6::baseos	before 0:1.3.1-16.el8_6.3	0:1.3.1-16.el8_6.3
`pam-devel` Red Hat:rhel_tus:8.6::baseos	before 0:1.3.1-16.el8_6.3	0:1.3.1-16.el8_6.3
`pam` Red Hat:rhel_els:7	before 0:1.1.8-23.el7_9.2	0:1.1.8-23.el7_9.2
`pam-debuginfo` Red Hat:rhel_els:7	before 0:1.1.8-23.el7_9.2	0:1.1.8-23.el7_9.2
`pam-devel` Red Hat:rhel_els:7	before 0:1.1.8-23.el7_9.2	0:1.1.8-23.el7_9.2
`pam` Red Hat:rhel_aus:8.2::baseos	before 0:1.3.1-8.el8_2.2	0:1.3.1-8.el8_2.2
`pam-debuginfo` Red Hat:rhel_aus:8.2::baseos	before 0:1.3.1-8.el8_2.2	0:1.3.1-8.el8_2.2
`pam-debugsource` Red Hat:rhel_aus:8.2::baseos	before 0:1.3.1-8.el8_2.2	0:1.3.1-8.el8_2.2
`pam-devel` Red Hat:rhel_aus:8.2::baseos	before 0:1.3.1-8.el8_2.2	0:1.3.1-8.el8_2.2
`pam` Rocky Linux:8 From an advisory covering 2 CVEs	before 0:1.3.1-38.el8_10	0:1.3.1-38.el8_10
`pam` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:1.5.1-26.el9_6	0:1.5.1-26.el9_6
`pam` Root:Ubuntu:22.04	before 1.4.0-11ubuntu2.8.aikido.9	1.4.0-11ubuntu2.8.aikido.9
`rootio-pam` Root:Ubuntu:22.04	before 1.4.0-11ubuntu2.8.aikido.9	1.4.0-11ubuntu2.8.aikido.9

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-8941 is a high vulnerability (CVSS 7.8) in Red Hat Cert-manager Operator For Red Hat Openshift 1.16, published August 13, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in pam 1.5.1-14.el9.tuxcare.els4.

References

Show 43 moreShow less