# CVE-2026-54411: libpam0g: Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-pass... CVE-2026-54411 is fixed in 14 products on 1 platform, first by libpam-cracklib 1.4.0-11ubuntu2.7, released June 14, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-54411 - Priority: Routine - CVSS: 4.8 (Medium) - EPSS: 0.0032 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jun 14, 2026 ## Description Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libpam-cracklib Ubuntu 22.04.1 LTS (jammy) | 1.4.0-11ubuntu2.7 | [libpam-cracklib 1.4.0-11ubuntu2.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libpam-cracklib-1.4.0-11ubuntu2.7.md) | Jun 14, 2026 | | Linux | libpam-modules Ubuntu 22.04.1 LTS (jammy) | 1.4.0-11ubuntu2.7 | [libpam-modules 1.4.0-11ubuntu2.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libpam-modules-1.4.0-11ubuntu2.7.md) | Jun 14, 2026 | | Linux | libpam-modules Ubuntu 24.04.5 LTS (noble) | 1.5.3-5ubuntu5.6 | [libpam-modules 1.5.3-5ubuntu5.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libpam-modules-1.5.3-5ubuntu5.6.md) | Jun 14, 2026 | | Linux | libpam-modules Ubuntu 26.04.1 LTS (resolute) | 1.7.0-5ubuntu3.1 | [libpam-modules 1.7.0-5ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libpam-modules-1.7.0-5ubuntu3.1.md) | Jun 14, 2026 | | Linux | libpam-modules-bin Ubuntu 22.04.1 LTS (jammy) | 1.4.0-11ubuntu2.7 | [libpam-modules-bin 1.4.0-11ubuntu2.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libpam-modules-bin-1.4.0-11ubuntu2.7.md) | Jun 14, 2026 | | Linux | libpam-modules-bin Ubuntu 24.04.5 LTS (noble) | 1.5.3-5ubuntu5.6 | [libpam-modules-bin 1.5.3-5ubuntu5.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libpam-modules-bin-1.5.3-5ubuntu5.6.md) | Jun 14, 2026 | | Linux | libpam-modules-bin Ubuntu 26.04.1 LTS (resolute) | 1.7.0-5ubuntu3.1 | [libpam-modules-bin 1.7.0-5ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libpam-modules-bin-1.7.0-5ubuntu3.1.md) | Jun 14, 2026 | | Linux | libpam-runtime Ubuntu 22.04.1 LTS (jammy) | 1.4.0-11ubuntu2.7 | [libpam-runtime 1.4.0-11ubuntu2.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libpam-runtime-1.4.0-11ubuntu2.7.md) | Jun 14, 2026 | | Linux | libpam-runtime Ubuntu 24.04.5 LTS (noble) | 1.5.3-5ubuntu5.6 | [libpam-runtime 1.5.3-5ubuntu5.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libpam-runtime-1.5.3-5ubuntu5.6.md) | Jun 14, 2026 | | Linux | libpam-runtime Ubuntu 26.04.1 LTS (resolute) | 1.7.0-5ubuntu3.1 | [libpam-runtime 1.7.0-5ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libpam-runtime-1.7.0-5ubuntu3.1.md) | Jun 14, 2026 | | Linux | libpam0g Ubuntu 22.04.1 LTS (jammy) | 1.4.0-11ubuntu2.7 | [libpam0g 1.4.0-11ubuntu2.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libpam0g-1.4.0-11ubuntu2.7.md) | Jun 14, 2026 | | Linux | libpam0g Ubuntu 24.04.5 LTS (noble) | 1.5.3-5ubuntu5.6 | [libpam0g 1.5.3-5ubuntu5.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libpam0g-1.5.3-5ubuntu5.6.md) | Jun 14, 2026 | | Linux | libpam0g Ubuntu 26.04.1 LTS (resolute) | 1.7.0-5ubuntu3.1 | [libpam0g 1.7.0-5ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libpam0g-1.7.0-5ubuntu3.1.md) | Jun 14, 2026 | | Linux | pam Fedora 43 | 1.7.1-5.fc43 | [FEDORA-2026-ADC8DDBEAA](https://patchblox.com/security/data/fix/linux/fedora-2026-adc8ddbeaa.md) | Jul 10, 2026 | | Linux | pam RHEL 10 | 1.6.1-8.el10_0.1 | [RHSA-2026:61229](https://patchblox.com/security/data/fix/linux/rhsa-2026-61229.md) | Jun 14, 2026 | | Linux | pam RHEL 8 | 0:1.3.1-40.el8_10 | [RHSA-2026:56131](https://patchblox.com/security/data/fix/linux/rhsa-2026-56131.md) | Aug 19, 2026 | | Linux | pam RHEL 9 | 0:1.5.1-28.el9_8.1 | [RHSA-2026:64815](https://patchblox.com/security/data/fix/linux/rhsa-2026-64815.md) | Aug 28, 2026 | | Linux | pam almalinux 10 | 1.6.1-9.el10_2.1 | [ALSA-2026:59379](https://patchblox.com/security/data/fix/linux/alsa-2026-59379.md) | Aug 25, 2026 | | Linux | pam almalinux 8 | 1.3.1-40.el8_10 | [ALSA-2026:56131](https://patchblox.com/security/data/fix/linux/alsa-2026-56131.md) | Aug 18, 2026 | | Linux | pam almalinux 9 | 1.5.1-28.el9_8.1 | [ALSA-2026:64815](https://patchblox.com/security/data/fix/linux/alsa-2026-64815.md) | Sep 8, 2026 | | Linux | pam ol 10 | 0:1.6.1-9.el10_2.1 | [ELSA-2026-59379](https://patchblox.com/security/data/fix/linux/elsa-2026-59379.md) | Aug 25, 2026 | | Linux | pam ol 8 | 0:1.3.1-40.0.1.el8_10 | [ELSA-2026-56131](https://patchblox.com/security/data/fix/linux/elsa-2026-56131.md) | Aug 18, 2026 | | Linux | pam ol 9 | 0:1.5.1-28.0.1.el9_8.1 | [ELSA-2026-60224-0](https://patchblox.com/security/data/fix/linux/elsa-2026-60224-0.md) | Aug 28, 2026 | | Linux | pam opensuse-leap 16.0 | 1.7.1-160000.5.1 | [OPENSUSE-SU-2026:21320-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21320-1.md) | Jul 13, 2026 | | Linux | pam rocky 10 | 0:1.6.1-9.el10_2.1 | [RLSA-2026:59379](https://patchblox.com/security/data/fix/linux/rlsa-2026-59379.md) | Aug 26, 2026 | | Linux | pam rocky 8 | 0:1.3.1-40.el8_10 | [RLSA-2026:56131](https://patchblox.com/security/data/fix/linux/rlsa-2026-56131.md) | Aug 19, 2026 | | Linux | pam rocky 9 | 0:1.5.1-28.el9_8.1 | [RLSA-2026:64815](https://patchblox.com/security/data/fix/linux/rlsa-2026-64815.md) | Sep 9, 2026 | | Linux | pam sles 15.7 | 1.3.0-150000.6.89.1 | [SUSE-SU-2026:3163-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3163-1.md) | Jul 21, 2026 | | Linux | pam sles 16.0 | 1.7.1-160000.5.1 | [SUSE-SU-2026:22639-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22639-1.md) | Jul 13, 2026 | | Linux | pam-debuginfo Fedora 43 | 1.7.1-5.fc43 | [FEDORA-2026-ADC8DDBEAA](https://patchblox.com/security/data/fix/linux/fedora-2026-adc8ddbeaa.md) | Jul 10, 2026 | | Linux | pam-debugsource Fedora 43 | 1.7.1-5.fc43 | [FEDORA-2026-ADC8DDBEAA](https://patchblox.com/security/data/fix/linux/fedora-2026-adc8ddbeaa.md) | Jul 10, 2026 | | Linux | pam-devel Fedora 43 | 1.7.1-5.fc43 | [FEDORA-2026-ADC8DDBEAA](https://patchblox.com/security/data/fix/linux/fedora-2026-adc8ddbeaa.md) | Jul 10, 2026 | | Linux | pam-devel RHEL 8 | 0:1.3.1-40.el8_10 | [RHSA-2026:56131](https://patchblox.com/security/data/fix/linux/rhsa-2026-56131.md) | Aug 19, 2026 | | Linux | pam-devel RHEL 9 | 0:1.5.1-28.el9_8.1 | [RHSA-2026:64815](https://patchblox.com/security/data/fix/linux/rhsa-2026-64815.md) | Aug 28, 2026 | | Linux | pam-devel almalinux 10 | 1.6.1-9.el10_2.1 | [ALSA-2026:59379](https://patchblox.com/security/data/fix/linux/alsa-2026-59379.md) | Aug 25, 2026 | | Linux | pam-devel almalinux 8 | 1.3.1-40.el8_10 | [ALSA-2026:56131](https://patchblox.com/security/data/fix/linux/alsa-2026-56131.md) | Aug 18, 2026 | | Linux | pam-devel almalinux 9 | 1.5.1-28.el9_8.1 | [ALSA-2026:64815](https://patchblox.com/security/data/fix/linux/alsa-2026-64815.md) | Sep 8, 2026 | | Linux | pam-devel ol 10 | 0:1.6.1-9.el10_2.1 | [ELSA-2026-59379](https://patchblox.com/security/data/fix/linux/elsa-2026-59379.md) | Aug 25, 2026 | | Linux | pam-devel ol 8 | 0:1.3.1-40.0.1.el8_10 | [ELSA-2026-56131](https://patchblox.com/security/data/fix/linux/elsa-2026-56131.md) | Aug 18, 2026 | | Linux | pam-devel ol 9 | 0:1.5.1-28.0.1.el9_8.1 | [ELSA-2026-60224-0](https://patchblox.com/security/data/fix/linux/elsa-2026-60224-0.md) | Aug 28, 2026 | | Linux | pam-doc Fedora 43 | 1.7.1-5.fc43 | [FEDORA-2026-ADC8DDBEAA](https://patchblox.com/security/data/fix/linux/fedora-2026-adc8ddbeaa.md) | Jul 10, 2026 | | Linux | pam-docs RHEL 9 | 0:1.5.1-28.el9_8.1 | [RHSA-2026:64815](https://patchblox.com/security/data/fix/linux/rhsa-2026-64815.md) | Aug 28, 2026 | | Linux | pam-docs almalinux 9 | 1.5.1-28.el9_8.1 | [ALSA-2026:64815](https://patchblox.com/security/data/fix/linux/alsa-2026-64815.md) | Sep 8, 2026 | | Linux | pam-docs ol 9 | 0:1.5.1-28.0.1.el9_8.1 | [ELSA-2026-60224-0](https://patchblox.com/security/data/fix/linux/elsa-2026-60224-0.md) | Aug 28, 2026 | | Linux | pam-full-src opensuse-leap 16.0 | 1.7.1-160000.5.1 | [OPENSUSE-SU-2026:21320-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21320-1.md) | Jul 13, 2026 | | Linux | pam-full-src sles 16.0 | 1.7.1-160000.5.1 | [SUSE-SU-2026:22639-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22639-1.md) | Jul 13, 2026 | | Linux | pam-libs Fedora 43 | 1.7.1-5.fc43 | [FEDORA-2026-ADC8DDBEAA](https://patchblox.com/security/data/fix/linux/fedora-2026-adc8ddbeaa.md) | Jul 10, 2026 | | Linux | pam-libs almalinux 10 | 1.6.1-9.el10_2.1 | [ALSA-2026:59379](https://patchblox.com/security/data/fix/linux/alsa-2026-59379.md) | Aug 25, 2026 | | Linux | pam-libs ol 10 | 0:1.6.1-9.el10_2.1 | [ELSA-2026-59379](https://patchblox.com/security/data/fix/linux/elsa-2026-59379.md) | Aug 25, 2026 | | Linux | pam-libs-debuginfo Fedora 43 | 1.7.1-5.fc43 | [FEDORA-2026-ADC8DDBEAA](https://patchblox.com/security/data/fix/linux/fedora-2026-adc8ddbeaa.md) | Jul 10, 2026 | --- Data as of 2026-11-09T13:31:49Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.