Observable Timing Discrepancy in Linux-PAM's pam_userdb Module

CVE-2026-54411

What is CVE-2026-54411?

The pam_userdb module in Linux-PAM up to version 1.7.2 suffers from an observable timing discrepancy during plaintext-password comparisons. This vulnerability enables local or network-adjacent attackers to disclose target account passwords by analyzing response timing variations in the authentication process. When the pam_userdb module is configured with crypt=none or an unrecognized crypt method, credentials are compared in plaintext. The comparison relies on strncmp(), leading to differential timing based on the first differing byte and the length of the candidate password, thereby exposing both the password length and leading bytes. Remediation is possible using the pam_consttime_streq helper to prevent such attacks.

References