New Linux PAM and Udisks Vulnerabilities (CVE-2025-6018 & CVE-2025-6019) Allow Full Root Access Across Major Distributions
Discover how critical Linux vulnerabilities CVE-2025-6018 and CVE-2025-6019 enable attackers to gain full root access via PAM misconfigurations and Udisks daemon. Affects Ubuntu, Debian, SUSE, Fedora & more. Learn mitigation steps and patching tips.
Introduction
In June 2026, cybersecurity researchers at Qualys revealed two critical privilege escalation vulnerabilities in Linux systems. These flaws can allow a regular, logged-in user to gain full root access across multiple major Linux distributions such as Ubuntu, Debian, Fedora, and openSUSE. The vulnerabilities are tracked as:
-
CVE-2025-6018 – A flaw in PAM (Pluggable Authentication Modules)
-
CVE-2025-6019 – A vulnerability in libblockdev exploited via the udisks daemon
This blog breaks down the technical aspects, potential risks, and how to protect your systems from these threats.
What Are These New Linux Vulnerabilities?
1. CVE-2025-6018 – Elevation via PAM in SUSE Linux
This vulnerability exists in the PAM configuration of SUSE Linux Enterprise 15 and openSUSE Leap 15. It allows a normal local user to escalate privileges to an “allow_active” user — a role that can invoke system-level actions normally reserved for physically present users.
2. CVE-2025-6019 – Root Access via Udisks (libblockdev)
After gaining “allow_active” access through the first vulnerability, attackers can exploit CVE-2025-6019 via the udisks daemon, which is present by default on most Linux systems. This chain allows them to escalate privileges to full root access.
Why Are These Flaws So Dangerous?
These two vulnerabilities can be chained together to achieve local-to-root escalation in seconds. A malicious user with any active GUI or SSH session can exploit them to:
-
Bypass authentication restrictions (Polkit)
-
Execute root-level commands
-
Plant backdoors or disable system defenses
According to Qualys, this chain collapses the security gap between a basic user and full system control.
Other Related Vulnerability: CVE-2025-6020
In addition to the above, Qualys also disclosed another vulnerability:
-
CVE-2025-6020 – Found in
pam_namespace, this path traversal flaw can be exploited via symlink attacks and race conditions, leading to root access on vulnerable systems.
It affects all systems using pam_namespace <= 1.7.0, particularly where user-controlled paths are involved in polyinstantiated directories.
Affected Linux Distributions
The vulnerabilities impact many popular distributions, including:
-
Ubuntu
-
Debian
-
Fedora
-
openSUSE Leap 15
-
SUSE Linux Enterprise 15
How Does the Attack Work?
Simplified Exploitation Chain:
-
Initial Access: An attacker gains access to a system (GUI or SSH session).
-
Privilege Escalation #1: CVE-2025-6018 lets them become an
allow_activeuser. -
Privilege Escalation #2: CVE-2025-6019 lets the
allow_activeuser use udisks to gain root access. -
System Compromise: Once root, the attacker can control the system completely.
How Can You Protect Your System?
✅ Apply Patches Immediately
Vendors like SUSE, Ubuntu, and Debian are releasing patches. Keep your systems updated using your distribution’s package manager.
Example for Debian-based systems:
sudo apt update && sudo apt upgrade
Temporary Mitigations
If patches aren’t available yet:
-
Modify Polkit Rules: Require admin authentication for the udisks action.
org.freedesktop.udisks2.modify-device: auth_admin
-
Disable pam_namespace or ensure it doesn't operate on user-controlled paths.
Impact on Linux Security
These flaws highlight how chained vulnerabilities can quickly elevate a simple local user to root — even on hardened systems. They also show the risks of misconfigured default services like udisks and the complexity of PAM.
Security researchers warn that similar “legitimate tool abuse” attacks could be used in future advanced persistent threats (APTs).
Key Takeaways
| Aspect | Details |
|---|---|
| Affected Systems | Ubuntu, Debian, Fedora, SUSE, openSUSE |
| Flaws | CVE-2025-6018 (PAM), CVE-2025-6019 (udisks), CVE-2025-6020 (pam_namespace) |
| Risk | Full root access from a basic local session |
| Exploitable by | GUI or SSH session users |
| Temporary Fix | Modify Polkit rules and disable vulnerable PAM modules |
| Permanent Fix | Apply vendor security patches ASAP |
Conclusion
These 2025 Linux vulnerabilities are a strong reminder that local security is just as critical as remote hardening. PAM misconfigurations and background daemons like udisks can be silently weaponized to compromise even seemingly secure systems.
System administrators and Linux users should take immediate steps to patch their systems, review PAM and Polkit configurations, and stay up to date with future security advisories.
FAQ
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Wow
0
Sad
0
Angry
0
Vaishnavi is a skilled tech professional at the Ethical Hacking Training Institute in Pune, responsible for managing and optimizing the technical infrastructure that supports advanced cybersecurity education. With deep expertise in network security, backend operations, and system performance, she ensures that practical labs, online modules, and assessments run smoothly and securely. Her behind-the-scenes contributions play a vital role in delivering a seamless and secure learning experience for aspiring ethical hackers.
