Linux-PAM CVE-2026-54411

No vendor-released patch identified at time of analysis - the references point to the upstream source repository (https://github.com/linux-pam/linux-pam) without identifying a tagged fix release or patched version number. The primary and most effective mitigation is to reconfigure pam_userdb to use a supported cryptographic hash (e.g., crypt=SHA512) for password storage, which eliminates the plaintext comparison path entirely; this requires regenerating the Berkeley DB credential database and a brief service restart. If reconfiguration is not immediately feasible, restrict network or local access to the authentication service consuming pam_userdb to only trusted principals via firewall rules or network segmentation, directly reducing the pool of potential timing oracle requestors. Rate-limiting authentication attempts at the service layer (e.g., via fail2ban or per-account lockout thresholds) significantly raises the cost and time required for a successful timing attack, though it does not eliminate the vulnerability. Migrating to an alternative PAM credential module (e.g., pam_unix with shadow passwords, which uses constant-time comparison) is a longer-term architectural remedy. Monitor https://github.com/linux-pam/linux-pam for a patched release addressing this timing path.