CVE-2025-8941

Public on 2025-08-13
Modified on 2025-08-25
Description
A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.
Severity
Medium severity
Medium
See what this means
CVSS v3 Base Score
6.3
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 pam No Fix Planned
Amazon Linux 2 - Core pam 2025-11-10 ALAS2-2025-3057 Fixed
Amazon Linux 2023 pam 2025-11-10 ALAS2023-2025-1257 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2025-8941 Mitre: CVE-2025-8941