This security advisory addresses a directory traversal vulnerability (CVE-2025-6020) in the Linux-PAM component of Red Hat Enterprise Linux 8. PAM enables flexible authentication policy configuration without recompiling programs. The directory traversal flaw could allow an attacker to access files or directories outside the intended scope. Red Hat has issued an update (pam-1.3.1-38.el8_10) to remediate this vulnerability across multiple supported architectures and extended life cycle releases. The advisory also references CVE-2025-8941, indicating multiple related issues fixed in this update. No exploits are currently known in the wild. The vendor rates the update as important, and the original source rates the severity as high. Detailed patch instructions are available in the Red Hat advisory article.

The vulnerability allows directory traversal in the PAM system, potentially enabling unauthorized access to files or directories. This could undermine system authentication security if exploited. However, no known exploits have been reported in the wild. The impact is considered high severity by the source and important by Red Hat, indicating a significant security risk if left unpatched.

Red Hat has released an official security update for PAM in Red Hat Enterprise Linux 8 to address this vulnerability. Users should apply the updated packages (pam-1.3.1-38.el8_10) available from Red Hat for their respective architectures and versions. Detailed update instructions are provided in the Red Hat advisory (https://access.redhat.com/articles/11258). There is no indication that additional mitigation steps are required beyond applying the official patch.