The vulnerability CVE-2025-6020 affects the linux-pam module pam_namespace, where it improperly limits pathnames to restricted directories. This flaw allows local users to exploit symlink attacks and race conditions to elevate their privileges to root. The issue is classified under CWE-22 (Path Traversal). Red Hat has released security advisories RHSA-2025:15099 and RHSA-2025:10024 providing updated pam packages that fix this vulnerability and an incomplete fix (CVE-2025-8941). The vulnerability affects multiple architectures and variants of Red Hat Enterprise Linux 9, including Extended Update Support and Update Services for SAP Solutions. The CVSS v3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a high severity with local attack vector, low attack complexity, and significant impact on confidentiality, integrity, and availability. Red Hat provides detailed patch instructions and package updates accessible via their official advisories and articles.

Successful exploitation of this vulnerability allows a local attacker to elevate privileges to root by exploiting symlink attacks and race conditions in the pam_namespace module. This results in full system compromise with high impact on confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported at this time.

Red Hat has released official security updates for the pam package that address CVE-2025-6020 and the related incomplete fix CVE-2025-8941. Users of Red Hat Enterprise Linux 9 and its Extended Update Support versions should apply these updates promptly. Detailed instructions and updated packages are available in Red Hat advisories RHSA-2025:15099 and RHSA-2025:10024 and the article https://access.redhat.com/articles/11258. Applying these patches mitigates the vulnerability effectively. No additional mitigation steps are required beyond applying the official fixes.