CVE-2024-22365

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

CVSS 3.1

5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-25)

CWE

CWE-664

Published

2024-02-06

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• linux-pam:linux-pam

References

• http://www.openwall.com/lists/oss-security/2024/01/18/3
• https://github.com/linux-pam/linux-pam
• https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb
• https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0
• http://www.openwall.com/lists/oss-security/2024/01/18/3

Check your stackJSON