CVE-2025-6020: Linux-pam: linux-pam directory traversal

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-17 · updated 2026-10-12
Weakness: CWE-22

Description

A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

Affected products

Red Hat cert-manager operator for Red Hat OpenShift 1.16: all versions — fixed in v1.16.5-1760515757
Red Hat Compliance Operator 1: all versions — fixed in 1.8.0
Red Hat Discovery 2: all versions — fixed in 2.0.0-1752592913, 2.2.1-1758555934
Red Hat Enterprise Linux 10: all versions — fixed in 0:1.6.1-8.el10
Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:1.6.1-8.el10_0
Red Hat Enterprise Linux 7 Extended Lifecycle Support: all versions — fixed in 0:1.1.8-23.el7_9.1
Red Hat Enterprise Linux 8: all versions — fixed in 0:1.3.1-37.el8_10, 0:1.3.1-38.el8_10
Red Hat Enterprise Linux 8.2 Advanced Update Support: all versions — fixed in 0:1.3.1-8.el8_2.1
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: all versions — fixed in 0:1.3.1-14.el8_4.1
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: all versions — fixed in 0:1.3.1-16.el8_6.2
Red Hat Enterprise Linux 8.6 Telecommunications Update Service: all versions — fixed in 0:1.3.1-16.el8_6.2
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions: all versions — fixed in 0:1.3.1-16.el8_6.2
Red Hat Enterprise Linux 8.8 Telecommunications Update Service: all versions — fixed in 0:1.3.1-26.el8_8.1
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: all versions — fixed in 0:1.3.1-26.el8_8.1
Red Hat Enterprise Linux 9: all versions — fixed in 0:1.5.1-25.el9_6, 0:1.5.1-26.el9_6
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions: all versions — fixed in 0:1.5.1-9.el9_0.2
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:1.5.1-15.el9_2.1
Red Hat Enterprise Linux 9.4 Extended Update Support: all versions — fixed in 0:1.5.1-24.el9_4
Red Hat Insights proxy 1.5: all versions — fixed in 1.5.7-1759331989
Red Hat OpenShift distributed tracing 3.6.0: all versions — fixed in rhosdt-3.6-1751993590, rhosdt-3.6-1752046437, rhosdt-3.6-1752046439, rhosdt-3.6-1752046452, rhosdt-3.6-1752070827, rhosdt-3.6-1752070833
Red Hat OpenShift sandboxed containers 1.10: all versions — fixed in 1.10.2-1757421804, 1.10.2-1757421879, 1.10.2-1757422110, 1.10.2-1757422401
Red Hat Web Terminal 1.11 on RHEL 9: all versions — fixed in 1.11-19, 1.11-8
Red Hat Web Terminal 1.12 on RHEL 9: all versions — fixed in 1.12-4
Red Hat RHEL-8 based Middleware Containers: all versions — fixed in 7.13.5-2.1752065733, 7.13.5-25, 7.13.5-3.1752065737, 7.13.5-4.1752065731, 7.13.5-4.1752065732, 7.13.5-4.1752065736
Red Hat RHOSS-1.36-RHEL-8: all versions — fixed in 1.36.0-10, 1.36.0-11, 1.36.0-12, 1.36.0-18, 1.36.0-4, 1.36.0-7

How to fix

Upgrade to a fixed version: Red Hat cert-manager operator for Red Hat OpenShift 1.16 v1.16.5-1760515757; Red Hat Compliance Operator 1 1.8.0; Red Hat Discovery 2 2.0.0-1752592913, 2.2.1-1758555934; Red Hat Enterprise Linux 10 0:1.6.1-8.el10; Red Hat Enterprise Linux 10.0 Extended Update Support 0:1.6.1-8.el10_0; Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.1.8-23.el7_9.1; Red Hat Enterprise Linux 8 0:1.3.1-37.el8_10, 0:1.3.1-38.el8_10; Red Hat Enterprise Linux 8.2 Advanced Update Support 0:1.3.1-8.el8_2.1; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:1.3.1-14.el8_4.1; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:1.3.1-16.el8_6.2; Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:1.3.1-16.el8_6.2; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:1.3.1-16.el8_6.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-6020 or the next vulnerability affects your stack