CVE-2026-54411 is a timing discrepancy vulnerability in the pam_userdb module of Linux-PAM, affecting Red Hat Hardened Images. The flaw allows an attacker with local or adjacent network access to recover plaintext passwords by repeatedly attempting authentication and measuring timing differences in password comparison. This vulnerability only applies when pam_userdb is configured to store and compare plaintext credentials, a non-default and discouraged setup in Red Hat Enterprise Linux environments. Red Hat has released updated RPM packages (pam-1.7.2-2.2.hum1 and related) to fix this issue. The vulnerability is categorized under CWE-208 (Observable Timing Discrepancy).

An attacker with local or network-adjacent access can exploit this vulnerability to recover plaintext passwords by analyzing timing discrepancies during authentication. The impact is limited by the requirement that pam_userdb be configured to store plaintext passwords, which is not the default configuration in Red Hat products. There is no impact on integrity or availability, and exploitation requires repeated authentication attempts.

Red Hat has released updated packages that fix this vulnerability. Administrators should apply the security update to upgrade pam and related packages to version 1.7.2-2.2.hum1 or later. Additionally, to mitigate the issue, ensure that the pam_userdb module is not configured to store or compare plaintext credentials. Use strong cryptographic hashing methods in pam_userdb configuration or disable the module if not required. Avoid using 'crypt=none' or omitting the 'crypt=' argument. After configuration changes, restart services relying on PAM to apply the changes.