CVE-2025-6020: Linux-pam: linux-pam directory traversal
A flaw was found in linux-pam. The module pamnamespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.
Other sources
The module pamnamespace in linux-pam <= 1.7.0 may access user-controlled paths without proper protections, which allows a local user to elevate their privileges to root via multiple symlink attacks and race conditions.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6020?
CVE-2025-6020 is considered to have a high severity due to the potential for privilege escalation to root.
How do I fix CVE-2025-6020?
To fix CVE-2025-6020, upgrade to linux-pam version 1.7.1 or newer where the vulnerability is resolved.
Who is affected by CVE-2025-6020?
CVE-2025-6020 affects users of linux-pam versions 1.7.0 and earlier.
What type of vulnerability is CVE-2025-6020?
CVE-2025-6020 is a local privilege escalation vulnerability.
What causes the vulnerability in CVE-2025-6020?
The vulnerability in CVE-2025-6020 is caused by improper handling of user-controlled paths in the pam_namespace module.