CVE-2025-6020 is a directory traversal vulnerability in the Linux PAM (Pluggable Authentication Modules) component used by Red Hat Enterprise Linux. This vulnerability allows an attacker to potentially access or manipulate files outside of intended directories due to improper handling of directory paths. The issue affects Red Hat Enterprise Linux versions 8 (including 8.0 through 8.10) and 9.4 Extended Update Support. Red Hat has issued security advisories RHSA-2025:10024 and RHSA-2025:10027 providing patches that fix this vulnerability. The vulnerability is tracked under multiple CWEs including CWE-22 (Path Traversal), CWE-476 (NULL Pointer Dereference), CWE-415 (Double Free), CWE-295 (Improper Certificate Validation), and CWE-122 (Heap-based Buffer Overflow), indicating multiple potential weaknesses in the PAM codebase. No known exploits in the wild have been reported.

The vulnerability could allow unauthorized directory traversal attacks within the PAM system, potentially leading to unauthorized file access or manipulation. This could compromise system authentication mechanisms or lead to privilege escalation. The severity is rated high by Red Hat Product Security. No active exploitation has been reported to date.

Red Hat has released official security updates that fix this vulnerability. Users should apply the linux-pam package updates provided in Red Hat Enterprise Linux 8.x and 9.4 Extended Update Support as detailed in advisories RHSA-2025:10024 and RHSA-2025:10027. The vendor advisory provides detailed instructions and package versions for patching. Applying these updates mitigates the vulnerability effectively.