A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10362 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10361 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10359 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10357 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10358 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10354 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0104 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-6020:
    A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without     proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks     and race conditions.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10180 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:10027 advisory.

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-10027 advisory.

    [1.3.1-37.0.1]
    - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36272695]

    [1.3.1-37]
    - pam_namespace: fix potential privilege escalation.
      Resolves: CVE-2025-6020 and RHEL-96724

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10027 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10024 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:9526 advisory.

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02013-1 advisory.

    - CVE-2025-6018: pam_env: Change the default to not read the user .pam_environment file (bsc#1243226).
    - CVE-2025-6020: pam_namespace: convert functions that may operate on a user-controlled path to operate on     file descriptors instead of absolute path (bsc#1244509).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-9526 advisory.

    [1.5.1-25.0.1]
    - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36406534]

    [1.5.1-25]
    - pam_namespace: fix potential privilege escalation.
      Resolves: CVE-2025-6020 and RHEL-96729

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9526 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-432b207745 advisory.

    pam_namespace: fix potential privilege escalation. Resolves: CVE-2025-6020

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7580-1 advisory.

    Olivier BAL-PETRE discovered that the PAM pam_namespace module incorrectly handled user-controlled paths.
    In environments where pam_namespace is used, a local attacker could possibly use this issue to escalate     their privileges to root.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241419	RHEL 8 : pam (RHSA-2025:10362)	Nessus	Red Hat Local Security Checks	high
241417	RHEL 8 : pam (RHSA-2025:10361)	Nessus	Red Hat Local Security Checks	high
241416	RHEL 8 : pam (RHSA-2025:10359)	Nessus	Red Hat Local Security Checks	high
241413	RHEL 7 : pam (RHSA-2025:10357)	Nessus	Red Hat Local Security Checks	high
241399	RHEL 8 : pam (RHSA-2025:10358)	Nessus	Red Hat Local Security Checks	high
241397	RHEL 9 : pam (RHSA-2025:10354)	Nessus	Red Hat Local Security Checks	high
241392	Alibaba Cloud Linux 3 : 0104: pam (ALINUX3-SA-2025:0104)	Nessus	Alibaba Cloud Linux Local Security Checks	high
241178	RHEL 9 : pam (RHSA-2025:10180)	Nessus	Red Hat Local Security Checks	high
241168	AlmaLinux 8 : pam (ALSA-2025:10027)	Nessus	Alma Linux Local Security Checks	high
241122	Oracle Linux 8 : pam (ELSA-2025-10027)	Nessus	Oracle Linux Local Security Checks	high
241109	RHEL 8 : pam (RHSA-2025:10027)	Nessus	Red Hat Local Security Checks	high
241080	RHEL 9 : pam (RHSA-2025:10024)	Nessus	Red Hat Local Security Checks	high
240935	AlmaLinux 9 : pam (ALSA-2025:9526)	Nessus	Alma Linux Local Security Checks	high
240745	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : pam (SUSE-SU-2025:02013-1)	Nessus	SuSE Local Security Checks	high
240504	Oracle Linux 9 : pam (ELSA-2025-9526)	Nessus	Oracle Linux Local Security Checks	high
240500	RHEL 9 : pam (RHSA-2025:9526)	Nessus	Red Hat Local Security Checks	high
240219	Fedora 42 : pam (2025-432b207745)	Nessus	Fedora Local Security Checks	high
240200	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : PAM vulnerability (USN-7580-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2025-6020

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high