This vulnerability (CVE-2025-8941) concerns an incomplete fix in the linux-pam package for Red Hat Enterprise Linux 8.2, related to a previous vulnerability CVE-2025-6020. PAM enables flexible authentication policy configuration, and the incomplete fix suggests that the prior patch did not fully resolve the underlying security issue. Red Hat has released an updated package (pam-1.3.1-8.el8_2.2) to address this. The advisory classifies the severity as Important but does not provide a CVSS score. The vulnerability is associated with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), indicating a potential path traversal or related issue.

The vulnerability affects Red Hat Enterprise Linux 8.2 systems using the linux-pam package. Because PAM is integral to authentication, an incomplete fix could allow attackers to bypass or manipulate authentication policies, potentially leading to unauthorized access or privilege escalation. The Red Hat advisory rates the impact as Important, indicating a significant security concern but not necessarily critical. There are no known exploits in the wild at the time of the advisory.

Red Hat has released an updated linux-pam package (pam-1.3.1-8.el8_2.2) that addresses the incomplete fix for CVE-2025-6020 (CVE-2025-8941). Users of affected Red Hat Enterprise Linux 8.2 systems should apply this update promptly following Red Hat's official guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated in the advisory. Patch status is confirmed as available via the vendor update.