Linux-PAM: Local privilege escalation in pam_namespace (CVE-2025-6020)
A local privilege escalation vulnerability in the Linux-PAM pam_namespace module allows low-privileged users to gain root access via symlink attacks and race conditions.
CVE search metadata
CVE search record: CVE-2025-6020. Severity: high. CVSS: 7.8. EPSS: 0.47%. KEV: no. Product: Linux-PAM (< 1.7.1). Brief: Linux-PAM: Local privilege escalation in pam_namespace (CVE-2025-6020). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2025-6020/
Triage facts
Revision 1- Applicability
- Linux-PAM (< 1.7.1)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 10, 16:59 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Likely
CVE-2025-6020 is a local privilege escalation vulnerability identified in the Linux-PAM pam_namespace module. The vulnerability, classified as CWE-22 (Improper Limitation of a Pathname Parameter), allows a low-privileged user to exploit race conditions and symlink attacks when the module handles user-controlled paths. This can lead to unauthorized escalation to root privileges. The issue was fixed in Linux-PAM version 1.7.1.
Impact
Successful exploitation allows a local user with low privileges to achieve root-level code execution on affected Linux systems.
Recommendation
- Upgrade Linux-PAM packages to version 1.7.1 or later across all Linux distributions.
- Audit systems for users with local shell access who might attempt to leverage this symlink/race condition vector.
Immediate actions
Patch Linux-PAM to version 1.7.1 or higher
Threat Hunt
Monitor for suspicious local symlink creation patterns in system-protected directories associated with pam_namespace operations.
Data: Auditd (syscall: symlink, symlinkat)
Mitigations
Upgrade to Linux-PAM 1.7.1
CVE-2025-6020