PoC Released for Linux-PAM Vulnerability Enabling Local Root Privilege Escalation

A new proof-of-concept (PoC) has been released for a serious vulnerability tracked as CVE-2025-8941, affecting the Pluggable Authentication Modules (PAM) used across Linux distributions. The flaw, rated 7.8 (High) on the CVSS scale, allows local attackers to elevate privileges to root through a race condition and symlink manipulation in the pam_namespace module.

It stems from improper handling of user-controlled paths during namespace setup, enabling attackers with low privileges to create symlinks that redirect PAM’s directory creation process toward sensitive system locations. When timed correctly, this redirection enables the creation or modification of files with root authority, effectively granting full system control and risking data leakage.

Administrators are urged to update all versions of Linux-PAM released before the latest vendor patch, and mitigations such as monitoring for unusual symlink creation and deploying host intrusion detection systems can offer partial protection but do not fix the underlying flaw.