{"id":"CVE-2026-3184","aliases":["AZL-81911","BELL-CVE-2026-3184","CLSA-2026-1782982174","DEBIAN-CVE-2026-3184","EUVD-2026-18817","GHSA-qp7r-5rpf-pwxg","OESA-2026-1532","OESA-2026-1533","OESA-2026-1534","OESA-2026-1535","OESA-2026-1633","OESA-2026-1634","OESA-2026-1635","OESA-2026-1636","RHSA-2026:7180","ROOT-OS-DEBIAN-12-CVE-2026-3184","ROOT-OS-DEBIAN-13-CVE-2026-3184","SUSE-SU-2026:0803-1","SUSE-SU-2026:0856-1","SUSE-SU-2026:0857-1","SUSE-SU-2026:0982-1","SUSE-SU-2026:0987-1","SUSE-SU-2026:1370-1","SUSE-SU-2026:1406-1","SUSE-SU-2026:20664-1","SUSE-SU-2026:20714-1","SUSE-SU-2026:21016-1","SUSE-SU-2026:21158-1","UBUNTU-CVE-2026-3184","USN-8702-1","openSUSE-SU-2026:10288-1","openSUSE-SU-2026:20495-1"],"status":"published","title":"Util-linux: util-linux: access control bypass due to improper hostname canonicalization","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00444,"percentile":0.38879,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-289"],"published":"2026-03-03T06:09:49.133909Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"util-linux","fixed_in":["2.40.2-4"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"util-linux","fixed_in":["2.38.1-r6"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"util-linux","fixed_in":["2.41-r8"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"util-linux","fixed_in":["2.41.3-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"util-linux","fixed_in":["2.38.1-r6"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"util-linux","fixed_in":["2.41-r8"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"util-linux","fixed_in":["2.41.3-r1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"util-linux","fixed_in":["2.42-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"util-linux","fixed_in":["2.39.1-35.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"util-linux","fixed_in":["2.39.1-35.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"util-linux","fixed_in":["2.39.1-35.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"util-linux","fixed_in":["2.39.1-35.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"util-linux","fixed_in":["2.35.2-28.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"util-linux","fixed_in":["2.37.2-50.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"util-linux","fixed_in":["2.38.1-5+deb12u3.aikido.6","2.38.1-5+deb12u3.aikido.17","2.38.1-5+deb12u3.aikido.7","2.38.1-5+deb12u3.root.io.5","2.38.1-5+deb12u3.root.io.4","2.38.1-5+deb12u3.aikido.8","2.38.1-5+deb12u3.aikido.18","2.38.1-5+deb12u3.aikido.9","2.38.1-5+deb12u3.aikido.10","2.38.1-5+deb12u3.aikido.11","2.38.1-5+deb12u3.aikido.12","2.38.1-5+deb12u3.aikido.13","2.38.1-5+deb12u3.aikido.14","2.38.1-5+deb12u3.aikido.15","2.38.1-5+deb12u3.aikido.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-util-linux","fixed_in":["2.38.1-5+deb12u3.aikido.6","2.38.1-5+deb12u3.aikido.17","2.38.1-5+deb12u3.aikido.7","2.38.1-5+deb12u3.root.io.5","2.38.1-5+deb12u3.root.io.4","2.38.1-5+deb12u3.aikido.8","2.38.1-5+deb12u3.aikido.18","2.38.1-5+deb12u3.aikido.9","2.38.1-5+deb12u3.aikido.10","2.38.1-5+deb12u3.aikido.11","2.38.1-5+deb12u3.aikido.12","2.38.1-5+deb12u3.aikido.13","2.38.1-5+deb12u3.aikido.14","2.38.1-5+deb12u3.aikido.15","2.38.1-5+deb12u3.aikido.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"util-linux","fixed_in":["2.41.5-0+deb13u1.aikido.14","2.41.5-0+deb13u1.aikido.7","2.41.5-0+deb13u1.aikido.8","2.41.5-0+deb13u1.aikido.9","2.41.5-0+deb13u1.aikido.10","2.41.5-0+deb13u1.aikido.11","2.41.5-0+deb13u1.aikido.15","2.41.5-0+deb13u1.aikido.12","2.41.5-0+deb13u1.aikido.13"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-util-linux","fixed_in":["2.41.5-0+deb13u1.aikido.14","2.41.5-0+deb13u1.aikido.7","2.41.5-0+deb13u1.aikido.8","2.41.5-0+deb13u1.aikido.9","2.41.5-0+deb13u1.aikido.10","2.41.5-0+deb13u1.aikido.11","2.41.5-0+deb13u1.aikido.15","2.41.5-0+deb13u1.aikido.12","2.41.5-0+deb13u1.aikido.13"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-libmount","fixed_in":["2.39.3-150600.4.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"util-linux","fixed_in":["2.39.3-150600.4.18.1","2.37.4-150500.9.23.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"util-linux-systemd","fixed_in":["2.39.3-150600.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"util-linux","fixed_in":["2.37.4-150500.9.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"util-linux-systemd","fixed_in":["2.37.4-150500.9.23.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python3-libmount","fixed_in":["2.37.4-150500.9.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"util-linux","fixed_in":["2.36.2-150300.4.53.1","2.36.2-150300.4.58.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"util-linux-systemd","fixed_in":["2.36.2-150300.4.53.1","2.36.2-150300.4.58.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"util-linux","fixed_in":["2.37.2-150400.8.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"util-linux-systemd","fixed_in":["2.37.2-150400.8.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"util-linux","fixed_in":["2.37.2-150400.8.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"util-linux-systemd","fixed_in":["2.37.2-150400.8.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python-libmount","fixed_in":["2.33.2-4.51.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"util-linux","fixed_in":["2.33.2-4.51.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"util-linux-systemd","fixed_in":["2.33.2-4.51.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"util-linux","fixed_in":["2.40.4-150700.4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"util-linux-systemd","fixed_in":["2.40.4-150700.4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"util-linux-systemd","fixed_in":["2.40.4-150700.4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"util-linux","fixed_in":["2.40.4-slfo.1.1_4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"util-linux-systemd","fixed_in":["2.40.4-slfo.1.1_4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"util-linux","fixed_in":["2.39.3-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"util-linux-systemd","fixed_in":["2.39.3-5.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"util-linux","fixed_in":["2.41.3-3ubuntu2.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"util-linux","fixed_in":["2.41.3-4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-4"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.38.1-r2"},{"fixed":"2.38.1-r6"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.41-r6"},{"fixed":"2.41-r8"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.39-r14"},{"fixed":"2.41.3-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.38.1-r2"},{"fixed":"2.38.1-r6"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.41-r6"},{"fixed":"2.41-r8"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.39-r14"},{"fixed":"2.41.3-r1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libblkid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-11.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libblkid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-11.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libfdisk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-11.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libfdisk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-11.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-11.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libmount-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-11.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libsmartcols","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-11.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libsmartcols-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-11.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libuuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-11.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libuuid-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-11.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-11.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-11.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"util-linux-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-11.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"util-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-11.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"uuidd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-11.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.38.1-5","2.38.1-5+deb12u1","2.38.1-5+deb12u2","2.38.1-5+deb12u3","2.38.1-5+loong64","2.38.1-6","2.39.1-1","2.39.1-2","2.39.1-3","2.39.1-4","2.39.2-1","2.39.2-2","2.39.2-2.1","2.39.2-2.2","2.39.2-3","2.39.2-4","2.39.2-5","2.39.2-6","2.39.3-1","2.39.3-10","2.39.3-11","2.39.3-2","2.39.3-3","2.39.3-4","2.39.3-5","2.39.3-6","2.39.3-6.1","2.39.3-6.1~exp1","2.39.3-7","2.39.3-8","2.39.3-9","2.40-1","2.40-2","2.40-3","2.40-4","2.40-5","2.40-6","2.40-7","2.40-8","2.40.1-1","2.40.1-2","2.40.1-3","2.40.1-4","2.40.1-4+hurd.1","2.40.1-6","2.40.1-7","2.40.1-8","2.40.1-8.1","2.40.1-9","2.40.2-1","2.40.2-10","2.40.2-11","2.40.2-12","2.40.2-12+hurd.1","2.40.2-13","2.40.2-14","2.40.2-2","2.40.2-3","2.40.2-4","2.40.2-5","2.40.2-6","2.40.2-7","2.40.2-8","2.40.2-9","2.40.3-1","2.40.4-1","2.40.4-2","2.40.4-3","2.40.4-4","2.40.4-5","2.40~rc2-1","2.40~rc2-2","2.40~rc2-3","2.40~rc2-4","2.40~rc2-5","2.40~rc2-6","2.40~rc2-7","2.40~rc2-8","2.41-1","2.41-2","2.41-3","2.41-4","2.41-5","2.41.1-1","2.41.1-2","2.41.1-3","2.41.1-4","2.41.2-1","2.41.2-2","2.41.2-3","2.41.2-4","2.41.3-1","2.41.3-2","2.41.3-3","2.41.3-4","2.41~rc1-1","2.41~rc1-2","2.41~rc2-1","2.42-1","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42.1-1","2.42.1-2","2.42.1-3","2.42.1-4","2.42.1-5","2.42.1-6","2.42.2-1","2.42.2-2","2.42.2-3","2.42.2-4","2.42.3-1","2.42.4-1","2.42~rc1-1","2.42~rc1-2","2.42~rc1-3","2.42~rc2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41-5","2.41.1-1","2.41.1-2","2.41.1-3","2.41.1-4","2.41.2-1","2.41.2-2","2.41.2-3","2.41.2-4","2.41.3-1","2.41.3-2","2.41.3-3","2.41.3-4","2.41.5-0+deb13u1","2.42-1","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42.1-1","2.42.1-2","2.42.1-3","2.42.1-4","2.42.1-5","2.42.1-6","2.42.2-1","2.42.2-2","2.42.2-3","2.42.2-4","2.42.3-1","2.42.4-1","2.42~rc1-1","2.42~rc1-2","2.42~rc1-3","2.42~rc2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42-1"}]}],"versions":["2.41-5","2.41.1-1","2.41.1-2","2.41.1-3","2.41.1-4","2.41.2-1","2.41.2-2","2.41.2-3","2.41.2-4","2.41.3-1","2.41.3-2","2.41.3-3","2.41.3-4","2.42~rc1-1","2.42~rc1-2","2.42~rc1-3","2.42~rc2-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.1-35.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.1-35.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.1-35.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.1-35.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-28.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.2-50.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.2-50.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-28.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42-7.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42-7.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42-7.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"util-linux-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42-7.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:Debian:12","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.1-5+deb12u3.aikido.6"},{"fixed":"2.38.1-5+deb12u3.aikido.17"},{"fixed":"2.38.1-5+deb12u3.aikido.7"},{"fixed":"2.38.1-5+deb12u3.root.io.5"},{"fixed":"2.38.1-5+deb12u3.root.io.4"},{"fixed":"2.38.1-5+deb12u3.aikido.8"},{"fixed":"2.38.1-5+deb12u3.aikido.18"},{"fixed":"2.38.1-5+deb12u3.aikido.9"},{"fixed":"2.38.1-5+deb12u3.aikido.10"},{"fixed":"2.38.1-5+deb12u3.aikido.11"},{"fixed":"2.38.1-5+deb12u3.aikido.12"},{"fixed":"2.38.1-5+deb12u3.aikido.13"},{"fixed":"2.38.1-5+deb12u3.aikido.14"},{"fixed":"2.38.1-5+deb12u3.aikido.15"},{"fixed":"2.38.1-5+deb12u3.aikido.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.1-5+deb12u3.aikido.6"},{"fixed":"2.38.1-5+deb12u3.aikido.17"},{"fixed":"2.38.1-5+deb12u3.aikido.7"},{"fixed":"2.38.1-5+deb12u3.root.io.5"},{"fixed":"2.38.1-5+deb12u3.root.io.4"},{"fixed":"2.38.1-5+deb12u3.aikido.8"},{"fixed":"2.38.1-5+deb12u3.aikido.18"},{"fixed":"2.38.1-5+deb12u3.aikido.9"},{"fixed":"2.38.1-5+deb12u3.aikido.10"},{"fixed":"2.38.1-5+deb12u3.aikido.11"},{"fixed":"2.38.1-5+deb12u3.aikido.12"},{"fixed":"2.38.1-5+deb12u3.aikido.13"},{"fixed":"2.38.1-5+deb12u3.aikido.14"},{"fixed":"2.38.1-5+deb12u3.aikido.15"},{"fixed":"2.38.1-5+deb12u3.aikido.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.5-0+deb13u1.aikido.14"},{"fixed":"2.41.5-0+deb13u1.aikido.7"},{"fixed":"2.41.5-0+deb13u1.aikido.8"},{"fixed":"2.41.5-0+deb13u1.aikido.9"},{"fixed":"2.41.5-0+deb13u1.aikido.10"},{"fixed":"2.41.5-0+deb13u1.aikido.11"},{"fixed":"2.41.5-0+deb13u1.aikido.15"},{"fixed":"2.41.5-0+deb13u1.aikido.12"},{"fixed":"2.41.5-0+deb13u1.aikido.13"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.5-0+deb13u1.aikido.14"},{"fixed":"2.41.5-0+deb13u1.aikido.7"},{"fixed":"2.41.5-0+deb13u1.aikido.8"},{"fixed":"2.41.5-0+deb13u1.aikido.9"},{"fixed":"2.41.5-0+deb13u1.aikido.10"},{"fixed":"2.41.5-0+deb13u1.aikido.11"},{"fixed":"2.41.5-0+deb13u1.aikido.15"},{"fixed":"2.41.5-0+deb13u1.aikido.12"},{"fixed":"2.41.5-0+deb13u1.aikido.13"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-150600.4.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-150600.4.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-150600.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-150500.9.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-150500.9.23.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python3-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-150500.9.23.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-150500.9.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36.2-150300.4.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36.2-150300.4.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.2-150400.8.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.2-150400.8.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.2-150400.8.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.2-150400.8.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36.2-150300.4.58.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36.2-150300.4.58.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-4.51.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-4.51.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-4.51.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.4-150700.4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.4-150700.4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.4-150700.4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.4-slfo.1.1_4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.4-slfo.1.1_4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.40.2-14ubuntu1","2.41-4ubuntu2","2.41-4ubuntu3","2.41-4ubuntu4","2.41-4ubuntu4.1","2.41-4ubuntu4.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41.3-3ubuntu2","2.42.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.3-3ubuntu2.2"}]}],"versions":["2.41-4ubuntu4","2.41.2-4ubuntu1","2.41.2-4ubuntu2","2.41.2-4ubuntu3","2.41.3-3ubuntu1","2.41.3-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.2-4ubuntu3.6"}]}],"versions":["2.36.1-8ubuntu1","2.37.2-4ubuntu1","2.37.2-4ubuntu2","2.37.2-4ubuntu3","2.37.2-4ubuntu3.3","2.37.2-4ubuntu3.4","2.37.2-4ubuntu3.5"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-9ubuntu6.6"}]}],"versions":["2.39.1-4ubuntu2","2.39.2-6ubuntu1","2.39.3-6ubuntu2","2.39.3-9ubuntu2","2.39.3-9ubuntu4","2.39.3-9ubuntu6","2.39.3-9ubuntu6.1","2.39.3-9ubuntu6.2","2.39.3-9ubuntu6.3","2.39.3-9ubuntu6.4","2.39.3-9ubuntu6.5"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.3-3ubuntu2.2"}]}],"versions":["2.41-4ubuntu4","2.41.2-4ubuntu1","2.41.2-4ubuntu2","2.41.2-4ubuntu3","2.41.3-3ubuntu1","2.41.3-3ubuntu2"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.3-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"kernel","product":"util-linux"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"redhat","product":"hardened_images"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:7180","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3184","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442570","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qp7r-5rpf-pwxg"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-3184","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1782982174.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28085","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14104","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27456","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-3184","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1532","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1533","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1534","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1535","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1633","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1634","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1635","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1636","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27456","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14104","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7180.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2419369","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14104","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3184","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454956","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27456","tags":["advisory"]},{"url":"https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4","tags":["article"]},{"url":"https://github.com/util-linux/util-linux/releases/tag/v2.41.4","tags":["article"]},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260803-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258859","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3184","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260856-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260857-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260982-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260987-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222465","tags":["report"]},{"url":"https://bugzilla.suse.com/1234736","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261370-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261406-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620664-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620714-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621016-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254666","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14104","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621158-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-3184","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8702-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-13595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-27456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53612","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53613","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53614","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53615","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-3184","title":"Util-linux: util-linux: access control bypass due to improper hostname canonicalization","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.","status":"published","published":"2026-04-03T18:43:45.725Z","modified":"2026-11-06T18:24:19.469Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-289"],"updated_at":"2026-11-06T19:59:19.701997Z"}],"euvd":[{"id":"EUVD-2026-18817","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.","status":"published","published":"2026-04-03T18:43:45Z","modified":"2026-11-06T18:24:19Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-06T19:05:52.672747Z"}],"ghsa":[{"id":"GHSA-qp7r-5rpf-pwxg","title":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility,...","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.","status":"published","published":"2026-04-03T21:31:42Z","modified":"2026-04-23T18:32:57Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-289"],"updated_at":"2026-11-02T15:07:36.455512Z"}],"nvd":[{"id":"CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.","status":"published","published":"2026-04-03T19:17:23.377Z","modified":"2026-11-06T19:17:49.787Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-289"],"updated_at":"2026-11-06T22:02:11.743368Z"}],"osv":[{"id":"BELL-CVE-2026-3184","status":"published","published":"2026-03-03T06:09:49.133909Z","modified":"2026-05-03T07:15:42.037081Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"DEBIAN-CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.","status":"published","published":"2026-04-03T19:17:23.377Z","modified":"2026-11-07T09:47:36.382998656Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-07T10:14:19.880839Z"},{"id":"OESA-2026-1532","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)","status":"published","published":"2026-03-06T11:10:32Z","modified":"2026-08-18T01:19:36.842485688Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1533","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)","status":"published","published":"2026-03-06T11:10:32Z","modified":"2026-08-18T01:19:36.405151106Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1534","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)","status":"published","published":"2026-03-06T11:10:32Z","modified":"2026-08-18T01:19:36.9051439Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1535","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)","status":"published","published":"2026-03-06T11:10:32Z","modified":"2026-08-18T01:19:36.747565026Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1633","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)","status":"published","published":"2026-03-15T07:32:55Z","modified":"2026-08-18T01:19:41.542286815Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1634","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)","status":"published","published":"2026-03-15T07:32:57Z","modified":"2026-08-18T01:19:40.427718301Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1635","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)","status":"published","published":"2026-03-20T11:10:40Z","modified":"2026-08-18T01:19:40.520590796Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1636","title":"util-linux security update","description":"The util-linux package contains a random collection of files that implements some low-level basic linux utilities.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in util-linux package that allows access control bypass due to improper hostname canonicalization.(CVE-2026-3184)","status":"published","published":"2026-03-20T11:10:40Z","modified":"2026-08-18T01:19:40.325946495Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"RHSA-2026:7180","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:11:06Z","modified":"2026-10-15T10:26:01Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-3184","title":"CVE-2026-3184 in util-linux - Patched by Root","description":"Root has patched CVE-2026-3184 in the util-linux package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-16T09:26:03Z","modified":"2026-10-16T10:15:05.626002783Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-3184","title":"CVE-2026-3184 in util-linux - Patched by Root","description":"Root has patched CVE-2026-3184 in the util-linux package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-10-16T09:34:01Z","modified":"2026-10-16T10:15:02.58976265Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:33.415244Z"},{"id":"UBUNTU-CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.","status":"published","published":"2026-04-03T19:17:00Z","modified":"2026-10-17T12:58:08.409728478Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"AZL-81911","title":"CVE-2026-3184 affecting package util-linux for versions less than 2.40.2-4","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.","status":"published","published":"2026-04-03T19:17:23Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"CLSA-2026-1782982174","title":"util-linux: Fix of 4 CVEs","description":"- CVE-2024-28085: wall: fix escape sequence injection in argv messages by\n  sanitizing characters through buf_putc_careful(), preventing arbitrary text\n  injection into other users' terminals (WallEscape)\n- CVE-2026-3184: login: use original FQDN for PAM_RHOST to prevent hostname\n  canonicalization from bypassing host-based PAM access control rules","status":"published","published":"2026-07-02T08:49:55Z","modified":"2026-10-26T09:30:24.061430175Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"openSUSE-SU-2026:10288-1","title":"libblkid-devel-2.41.3-4.1 on GA media","description":"These are all security issues fixed in the libblkid-devel-2.41.3-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-04T00:00:00Z","modified":"2026-03-23T04:54:39.407532Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20495-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\nSecurity issues:\n\n- CVE-2025-14104: heap buffer overread in setpwnam() when processing 256-byte usernames (bsc#1254666).\n- CVE-2026-3184: access control bypass due to improper hostname canonicalization in `login` (bsc#1258859).\n\nNon security issues:\n\n- fdisk: Fix possible partition overlay and data corruption if EBR gap is missing  (bsc#1222465).\n- lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682).\n","status":"published","published":"2026-04-09T13:00:19Z","modified":"2026-04-22T18:26:08.6063Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0803-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2026-3184: Fix full hostname usage for PAM to ensure correct access control for 'login -h' (bsc#1258859).\n","status":"published","published":"2026-03-04T12:57:40Z","modified":"2026-03-05T21:15:07.461294Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0856-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2026-3184: Fix full hostname usage for PAM to ensure correct access control for 'login -h' (bsc#1258859).\n","status":"published","published":"2026-03-10T08:35:29Z","modified":"2026-03-13T06:42:20.691929Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0857-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2026-3184: Fix full hostname usage for PAM to ensure correct access control for 'login -h' (bsc#1258859).\n","status":"published","published":"2026-03-10T11:01:32Z","modified":"2026-03-13T06:42:20.898884Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0982-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2026-3184: Fix full hostname usage for PAM to ensure correct access control for 'login -h' (bsc#1258859).\n","status":"published","published":"2026-03-23T16:48:30Z","modified":"2026-03-25T08:31:12.945213Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0987-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\nSecurity issue:\n\n- CVE-2026-3184: access control bypass due to improper hostname canonicalization in `login` (bsc#1258859).\n\nNon security issues:\n\n- recognize fuse 'portal' as a virtual file system (bsc#1234736).\n- fdisk: fix possible partition overlay and data corruption if EBR gap is missing (bsc#1222465).\n","status":"published","published":"2026-03-24T03:11:26Z","modified":"2026-03-25T08:31:28.545787Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1370-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2026-3184: Fix full hostname usage for PAM to ensure correct access control for 'login -h' (bsc#1258859).\n","status":"published","published":"2026-04-15T14:44:52Z","modified":"2026-04-16T08:31:59.533281Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1406-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\nSecurity issue:\n\n- CVE-2026-3184: access control bypass due to improper hostname canonicalization in `login` (bsc#1258859).\n\nNon security issues:\n\n- recognize fuse 'portal' as a virtual file system (bsc#1234736).\n- fdisk: fix possible partition overlay and data corruption if EBR gap is missing (bsc#1222465).\n","status":"published","published":"2026-04-16T12:35:29Z","modified":"2026-04-17T09:01:43.48544Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:20664-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issue:\n\n- CVE-2026-3184: access control bypass due to improper hostname canonicalization in `login` (bsc#1258859).\n","status":"published","published":"2026-03-10T18:35:27Z","modified":"2026-03-23T04:53:06.757768Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20714-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issue:\n\n- CVE-2026-3184: access control bypass due to improper hostname canonicalization in `login` (bsc#1258859).\n","status":"published","published":"2026-03-10T08:40:03Z","modified":"2026-03-23T04:53:09.119317Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21016-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\nSecurity issues:\n\n- CVE-2025-14104: heap buffer overread in setpwnam() when processing 256-byte usernames (bsc#1254666).\n- CVE-2026-3184: access control bypass due to improper hostname canonicalization in `login` (bsc#1258859).\n\nNon security issues:\n\n- fdisk: Fix possible partition overlay and data corruption if EBR gap is missing  (bsc#1222465).\n- lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682).\n","status":"published","published":"2026-04-09T13:04:04Z","modified":"2026-04-14T18:27:05.7997Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21158-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\nSecurity issues:\n\n- CVE-2025-14104: heap buffer overread in setpwnam() when processing 256-byte usernames (bsc#1254666).\n- CVE-2026-3184: access control bypass due to improper hostname canonicalization in `login` (bsc#1258859).\n\nNon security issues:\n\n- fdisk: Fix possible partition overlay and data corruption if EBR gap is missing  (bsc#1222465).\n- lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682).\n","status":"published","published":"2026-04-09T13:04:04Z","modified":"2026-04-22T18:25:04.02694Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"USN-8702-1","title":"util-linux vulnerabilities","description":"It was discovered that libblkid in util-linux had a heap use-after-free\nvulnerability during nested partition probing. An attacker who could\npresent a crafted block device image could possibly use this issue to\nobtain sensitive information or cause a denial of service. (CVE-2026-13595)\n\nIt was discovered that the mount utility in util-linux had a time-of-check-\ntime-of-use vulnerability when setting up loop devices. A local attacker\ncould possibly use this issue to obtain unauthorized read access to root-\nprotected files and block devices. (CVE-2026-27456)\n\nIt was discovered that the login utility in util-linux improperly\ncanonicalized hostnames when invoked with the -h option. A remote attacker\ncould possibly use this issue to bypass host-based access control rules.\nThis issue only affected Ubuntu 26.04 LTS. (CVE-2026-3184)\n\nIt was discovered that libmount in util-linux had a time-of-check-time-of-\nuse vulnerability in its ownership hook. A local attacker could possibly\nuse this issue to gain elevated privileges. This issue only affected Ubuntu\n24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-53612)\n\nIt was discovered that libmount in util-linux had a time-of-check-time-of-\nuse vulnerability that allowed target path redirection during mount\noperations. A local attacker could possibly use this issue to gain elevated\nprivileges. (CVE-2026-53613)\n\nIt was discovered that libmount in util-linux improperly handled the\nLIBMOUNT_FORCE_MOUNT2 environment variable in the SUID mount utility. A\nlocal attacker could possibly use this issue to bypass nosuid and noexec\nmount options and gain elevated privileges. This issue only affected Ubuntu\n24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-53614)\n\nIt was discovered that libblkid in util-linux had an integer overflow\nvulnerability when parsing DOS partition tables. An attacker who could\npresent a crafted block device image could possibly use this issue to cause\na denial of service. (CVE-2026-53615)","status":"published","published":"2026-08-31T12:39:05Z","modified":"2026-10-17T12:55:29.41236116Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}