The Red Hat security advisory RHSA-2025:15099 addresses two vulnerabilities in the linux-pam package: CVE-2025-6020, a directory traversal vulnerability, and CVE-2025-8941, which is an incomplete fix for the first issue. PAM is a system that manages authentication policies without requiring recompilation of programs. These vulnerabilities could allow attackers to traverse directories improperly, potentially leading to unauthorized access or privilege escalation. The advisory covers Red Hat Enterprise Linux 9 across various architectures including x86_64, s390x, ppc64le, and aarch64. Red Hat has issued updated packages to fix these issues, and detailed update instructions are available in their knowledge base article.

The vulnerabilities involve directory traversal in PAM, which could allow an attacker to access or manipulate files outside intended directories during authentication processes. This could lead to unauthorized access or privilege escalation on affected systems. The advisory classifies the impact as Important, indicating a high severity level. No exploits are currently known to be active in the wild.

Red Hat has released updated linux-pam packages that address both CVE-2025-6020 and CVE-2025-8941. Users of Red Hat Enterprise Linux 9 and related variants should apply these updates promptly following the instructions in Red Hat's advisory and knowledge base article (https://access.redhat.com/articles/11258). Since this is an official fix, applying the update fully mitigates the vulnerabilities. No additional mitigation steps are indicated by the vendor.