# CVE-2026-3184: Util-linux: util-linux: access control bypass due to improper hostname canonicalization

CVE-2026-3184 is fixed in 22 products on 1 platform, first by SUSE-SU-2026:0803-1, released March 4, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-3184
- Priority: Routine
- CVSS: 5.3 (Low)
- EPSS: 0.0044
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 4, 2026
- Weakness: Authentication Bypass by Alternate Name
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3184

## Description

A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | bsdextrautils Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [bsdextrautils 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-bsdextrautils-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | bsdutils Ubuntu 26.04.1 LTS (resolute) | 1:2.41.3-3ubuntu2.2 | [bsdutils 1:2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-bsdutils-1-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | eject Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [eject 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-eject-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | fdisk Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [fdisk 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-fdisk-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | lastlog2 Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [lastlog2 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-lastlog2-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | libblkid1 Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [libblkid1 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libblkid1-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | libfdisk1 Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [libfdisk1 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libfdisk1-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | liblastlog2-2 Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [liblastlog2-2 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-liblastlog2-2-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | libmount1 Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [libmount1 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libmount1-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | libpam-lastlog2 Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [libpam-lastlog2 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libpam-lastlog2-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | libsmartcols1 Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [libsmartcols1 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libsmartcols1-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | libuuid1 Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [libuuid1 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libuuid1-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | login Ubuntu 26.04.1 LTS (resolute) | 1:4.16.0-2+really2.41.3-3ubuntu2.2 | [login 1:4.16.0-2+really2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-login-1-4.16.0-2-really2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | mount Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [mount 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-mount-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | python-libmount opensuse-leap 15.6 | 2.39.3-150600.4.18.1 | [SUSE-SU-2026:0803-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0803-1.md) | Mar 4, 2026 |
| Linux | python-libmount opensuse-leap 16.0 | 2.41.1-160000.3.1 | [OPENSUSE-SU-2026:20495-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20495-1.md) | Apr 9, 2026 |
| Linux | python-libmount sles 16.0 | 2.41.1-160000.3.1 | [SUSE-SU-2026:21158-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-21158-1.md) | Apr 9, 2026 |
| Linux | python3-libmount opensuse-leap 15.6 | 2.37.4-150500.9.23.1 | [SUSE-SU-2026:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0856-1.md) | Mar 10, 2026 |
| Linux | rfkill Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [rfkill 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rfkill-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | util-linux Debian 14 | 2.42-1 | [DEBIAN-CVE-2026-3184](https://patchblox.com/security/data/fix/linux/debian-cve-2026-3184.md) | Apr 3, 2026 |
| Linux | util-linux Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [util-linux 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-util-linux-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | util-linux opensuse-leap 15.6 | 2.37.4-150500.9.23.1 | [SUSE-SU-2026:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0856-1.md) | Mar 10, 2026 |
| Linux | util-linux opensuse-leap 16.0 | 2.41.1-160000.3.1 | [OPENSUSE-SU-2026:20495-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20495-1.md) | Apr 9, 2026 |
| Linux | util-linux sles 15.7 | 2.40.4-150700.4.10.1 | [SUSE-SU-2026:1406-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1406-1.md) | Apr 16, 2026 |
| Linux | util-linux sles 16.0 | 2.41.1-160000.3.1 | [SUSE-SU-2026:21158-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-21158-1.md) | Apr 9, 2026 |
| Linux | util-linux-extra Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [util-linux-extra 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-util-linux-extra-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | util-linux-locales Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [util-linux-locales 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-util-linux-locales-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |
| Linux | util-linux-systemd opensuse-leap 15.6 | 2.39.3-150600.4.18.1 | [SUSE-SU-2026:0803-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0803-1.md) | Mar 4, 2026 |
| Linux | util-linux-systemd opensuse-leap 16.0 | 2.41.1-160000.3.1 | [OPENSUSE-SU-2026:20495-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20495-1.md) | Apr 9, 2026 |
| Linux | util-linux-systemd sles 15.7 | 2.40.4-150700.4.10.1 | [SUSE-SU-2026:1406-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1406-1.md) | Apr 16, 2026 |
| Linux | util-linux-systemd sles 16.0 | 2.41.1-160000.3.1 | [SUSE-SU-2026:21158-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-21158-1.md) | Apr 9, 2026 |
| Linux | uuid-runtime Ubuntu 26.04.1 LTS (resolute) | 2.41.3-3ubuntu2.2 | [uuid-runtime 2.41.3-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-uuid-runtime-2.41.3-3ubuntu2.2.md) | Jun 29, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.