CVE-2026-54411

Name of the Vulnerable Software and Affected Versions Linux-PAM versions prior to 1.7.3

Description A timing discrepancy exists in the pam userdb module's plaintext-password comparison path within modules/pam userdb/pam userdb.c. A local or network-adjacent attacker can recover the plaintext password of a target account by measuring response-timing differences when repeatedly driving authentication through a calling service. The issue occurs because the comparison uses strncmp() (or strncasecmp() when PAM ICASE ARG is set) after a length-equality check, causing the rejection time to depend on the password length and the index of the first differing byte. This path is triggered when the administrator configures pam userdb with crypt=none, an unrecognized crypt method, or without a crypt= argument, leading the module to store and compare credentials in plaintext.

Recommendations Update to a version later than 1.7.2. Avoid configuring pam userdb with crypt=none, an unrecognized crypt method, or without a crypt= argument to prevent the use of plaintext password comparisons.