Which versions of pam_authnft are affected by EUVD-2026-29474?

pam_authnft versions prior to 0.2.0-alpha contain a heap buffer over-read vulnerability that allows unauthenticated remote attackers to crash the authentication module via malformed network messages,…. A patch is available.

How to fix or mitigate EUVD-2026-29474?

Within 24 hours: inventory all systems running pam_authnft and confirm current version. Within 7 days: upgrade pam_authnft to version 0.2.0-alpha or later on all affected systems and validate via package manager or GitHub release verification. Within 30 days: conduct post-patch testing of authentication workflows and review netlink message filtering rules on affected hosts.

pam_authnft EUVD-2026-29474

Q: What is the CVSS score of EUVD-2026-29474?

EUVD-2026-29474 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-43916 HIGH

Out-of-bounds Read (CWE-125)

2026-05-12 GitHub_M

Information Disclosure Buffer Overflow Pam Authnft

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 12, 2026 - 16:32 vuln.today

Analysis Generated

May 12, 2026 - 16:32 vuln.today

Patch available

May 12, 2026 - 15:02 EUVD

CVSS changed

May 12, 2026 - 14:22 NVD

8.7 (HIGH)

CVE Published

May 12, 2026 - 13:31 nvd

UNKNOWN (no severity yet)

CVE Published

May 12, 2026 - 13:31 nvd

HIGH 8.7

DescriptionGitHub Advisory

pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes. Prior to 0.2.0-alpha, a heap buffer over-read in peer_lookup_tcp (src/peer_lookup.c:134, prior to the fix) allowed a crafted NETLINK_SOCK_DIAG reply to slip past the message-size check, then dereference past the end of the allocation. This vulnerability is fixed in 0.2.0-alpha.

AnalysisAI

Heap buffer over-read in pam_authnft allows remote denial-of-service via crafted netlink messages. pam_authnft < 0.2.0-alpha contains a CWE-125 buffer over-read in the peer_lookup_tcp function when parsing NETLINK_SOCK_DIAG replies, allowing unauthenticated network attackers to trigger crashes by sending malformed netlink diagnostic messages that bypass message-size validation. This PAM module binds nftables firewall rules to authenticated sessions, so exploitation disrupts authentication infrastructure. Vendor-released patch: 0.2.0-alpha (GitHub PR #10). No public exploit identified at time of analysis.

Technical ContextAI

pam_authnft is a PAM (Pluggable Authentication Modules) session module that integrates Linux nftables firewall rules with user sessions by tracking cgroup v2 inodes. The vulnerability resides in src/peer_lookup.c:134 where peer_lookup_tcp processes netlink socket diagnostic messages (NETLINK_SOCK_DIAG protocol, part of Linux kernel's socket monitoring subsystem). The flaw is a classic CWE-125 heap buffer over-read: the function's message-size check was insufficient to prevent dereferencing memory past the end of the allocated heap buffer when processing specially crafted netlink replies. The CPE identifier cpe:2.3:a:identd-ng:pam_authnft confirms this affects the identd-ng project's PAM authentication NFT integration component. The fix in PR #10 introduced fuzzing harnesses including fuzz_netlink_diag specifically targeting the NETLINK_SOCK_DIAG parsing path, indicating the vendor recognized this attack surface during security hardening.

RemediationAI

Upgrade to pam_authnft version 0.2.0-alpha or later, which contains the fix delivered via GitHub PR #10 (https://github.com/identd-ng/pam_authnft/pull/10). The patch adds comprehensive input validation to peer_lookup_tcp and introduces five new fuzzing harnesses (fuzz_netlink_diag, fuzz_keyring_sanitize, fuzz_correlation_capture, fuzz_cgroup_path, fuzz_socket_inode) to prevent regression. Review the vendor security advisory at https://github.com/identd-ng/pam_authnft/security/advisories/GHSA-5jj5-hm34-78vh for complete remediation steps. If immediate upgrade is not feasible, consider temporarily disabling pam_authnft in PAM configuration files (/etc/pam.d/*) and reverting to static nftables rules, though this eliminates per-session firewall binding and may reduce security posture. Monitor authentication logs for unexpected PAM module crashes. Network-level mitigation is not applicable as netlink sockets are kernel-internal IPC; standard network firewalls do not filter this traffic.