A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without     proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks     and race conditions. (CVE-2025-6020)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202508-01 (PAM: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in PAM. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1121 advisory.

    A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without     proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks     and race conditions. (CVE-2025-6020)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of pam installed on the remote host is prior to 1.1.8-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2950 advisory.

    A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without     proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks     and race conditions. (CVE-2025-6020)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:10027 advisory.

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of pam installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-6020 advisory.

  - A flaw was found in linux-pam. The module pam_namespace May use access user-controlled paths without     proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks     and race conditions. (CVE-2025-6020)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of pam installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-6020 advisory.

  - A flaw was found in linux-pam. The module pam_namespace May use access user-controlled paths without     proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks     and race conditions. (CVE-2025-6020)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10362 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10361 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10359 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10357 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10358 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10354 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0104 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-6020:
    A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without     proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks     and race conditions.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10180 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:10027 advisory.

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-10027 advisory.

    [1.3.1-37.0.1]
    - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36272695]

    [1.3.1-37]
    - pam_namespace: fix potential privilege escalation.
      Resolves: CVE-2025-6020 and RHEL-96724

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10027 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10024 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:9526 advisory.

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02013-1 advisory.

    - CVE-2025-6018: pam_env: Change the default to not read the user .pam_environment file (bsc#1243226).
    - CVE-2025-6020: pam_namespace: convert functions that may operate on a user-controlled path to operate on     file descriptors instead of absolute path (bsc#1244509).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-9526 advisory.

    [1.5.1-25.0.1]
    - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36406534]

    [1.5.1-25]
    - pam_namespace: fix potential privilege escalation.
      Resolves: CVE-2025-6020 and RHEL-96729

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9526 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-432b207745 advisory.

    pam_namespace: fix potential privilege escalation. Resolves: CVE-2025-6020

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7580-1 advisory.

    Olivier BAL-PETRE discovered that the PAM pam_namespace module incorrectly handled user-controlled paths.
    In environments where pam_namespace is used, a local attacker could possibly use this issue to escalate     their privileges to root.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
244020	Linux Distros Unpatched Vulnerability : CVE-2025-6020	Nessus	Misc.	high
243975	GLSA-202508-01 : PAM: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
243491	Amazon Linux 2023 : pam, pam-devel (ALAS2023-2025-1121)	Nessus	Amazon Linux Local Security Checks	high
243431	Amazon Linux 2 : pam (ALAS-2025-2950)	Nessus	Amazon Linux Local Security Checks	high
243176	RockyLinux 8 : pam (RLSA-2025:10027)	Nessus	Rocky Linux Local Security Checks	high
242235	CBL Mariner 2.0 Security Update: pam (CVE-2025-6020)	Nessus	MarinerOS Local Security Checks	high
242231	Azure Linux 3.0 Security Update: pam (CVE-2025-6020)	Nessus	Azure Linux Local Security Checks	high
241419	RHEL 8 : pam (RHSA-2025:10362)	Nessus	Red Hat Local Security Checks	high
241417	RHEL 8 : pam (RHSA-2025:10361)	Nessus	Red Hat Local Security Checks	high
241416	RHEL 8 : pam (RHSA-2025:10359)	Nessus	Red Hat Local Security Checks	high
241413	RHEL 7 : pam (RHSA-2025:10357)	Nessus	Red Hat Local Security Checks	high
241399	RHEL 8 : pam (RHSA-2025:10358)	Nessus	Red Hat Local Security Checks	high
241397	RHEL 9 : pam (RHSA-2025:10354)	Nessus	Red Hat Local Security Checks	high
241392	Alibaba Cloud Linux 3 : 0104: pam (ALINUX3-SA-2025:0104)	Nessus	Alibaba Cloud Linux Local Security Checks	high
241178	RHEL 9 : pam (RHSA-2025:10180)	Nessus	Red Hat Local Security Checks	high
241168	AlmaLinux 8 : pam (ALSA-2025:10027)	Nessus	Alma Linux Local Security Checks	high
241122	Oracle Linux 8 : pam (ELSA-2025-10027)	Nessus	Oracle Linux Local Security Checks	high
241109	RHEL 8 : pam (RHSA-2025:10027)	Nessus	Red Hat Local Security Checks	high
241080	RHEL 9 : pam (RHSA-2025:10024)	Nessus	Red Hat Local Security Checks	high
240935	AlmaLinux 9 : pam (ALSA-2025:9526)	Nessus	Alma Linux Local Security Checks	high
240745	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : pam (SUSE-SU-2025:02013-1)	Nessus	SuSE Local Security Checks	high
240504	Oracle Linux 9 : pam (ELSA-2025-9526)	Nessus	Oracle Linux Local Security Checks	high
240500	RHEL 9 : pam (RHSA-2025:9526)	Nessus	Red Hat Local Security Checks	high
240219	Fedora 42 : pam (2025-432b207745)	Nessus	Fedora Local Security Checks	high
240200	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : PAM vulnerability (USN-7580-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2025-6020

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high