CVE-2026-3184: Util-linux: util-linux: access control bypass due to improper hostname canonicalization
A flaw was found in util-linux. Improper hostname canonicalization in the login(1) utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAMRHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
Other sources
Summary: Improper hostname canonicalization in util-linux login(1) when invoked with -h can modify the supplied remote hostname before setting PAMRHOST, potentially allowing bypass of host-based PAM access control rules (e.g., pamaccess) that rely on fully qualified domain names.
Requirements to exploit: An attacker must be able to access a remote login pathway that invokes login(1) with the -h <remotehost> option (e.g., telnet/rlogin-style daemons or custom wrappers). The target system must use PAM modules relying on PAMRHOST for authorization decisions (such as pamaccess) and have rules that distinguish between FQDNs and short hostnames. The local system hostname must share the same domain suffix as the attacker-supplied hostname.
— Red Hat
Util-linux: util-linux: access control bypass due to improper hostname canonicalization
— Microsoft