CVE-2026-54411 Details

A timing discrepancy vulnerability has been identified in the Linux-PAM authentication framework, specifically in versions through 1.7.2. The issue resides within the pam_userdb module's plaintext password comparison process. When the module is configured to handle passwords in plaintext, a local or network-adjacent attacker can exploit this timing discrepancy to recover the plaintext password of a target account. The vulnerability arises because the password comparison uses strncmp() (or strncasecmp() with PAM_ICASE_ARG enabled), creating a timing side channel that leaks information about the password length and individual prefix bytes. This vulnerable path is activated when the pam_userdb module is set to crypt=none, an unrecognized crypt method, or lacks a crypt= argument altogether.