Linux-PAM pam_userdb timing bug leaks plaintext passwords
CVE-2026-54411 affects Linux-PAM 1.7.2: the pam_userdb module leaks password length and prefix bytes via a timing discrepancy in its plaintext comparison. An attacker who can repeatedly trigger authentication can recover the full password when pam_userdb is configured with crypt=none or an unrecognized method.