Hi,

CVE-2026-54411 (Linux-PAM through 1.7.2): pam_userdb compares plaintext
passwords (crypt=none, also in key_only mode) with strncmp/strncasecmp and
a length pre-check, so response timing leaks the password prefix and
length. The security tracker lists it as unfixed in sid with no Debian
bug yet, hence this report.

Upstream fix: linux-pam commit 30708d973b63891bf700299ce3ae0f1086398284
(issue #992, PR #991 on GitHub; released in 1.7.3). It applies to 1.7.0-8
without fuzz; the pam_consttime_streq() and pam_overwrite_string() helpers
it uses are already in 1.7.0. Attached is a debdiff for a 1.7.0-8.1 NMU
adding it as
debian/patches/upstream/0026-pam_userdb-fix-password-comparison-timing-leak.patch.
I have not uploaded anything.

Testing (sid chroot, amd64):

- meson test suite: 82 ok, 0 failed.
- a functional test driving pam_userdb through pam_authenticate() with
test-only PAM services, comparing the stock and patched module: 24
cases (plain and key_only, with and without icase: correct password,
wrong same-length, prefix, longer, empty, wrong case, unknown user,
user-name prefix) give identical results.
- I did not try to measure the timing difference itself; PAM overhead
dwarfs a strncmp, so that part rests on the upstream review.
- lintian: source tags identical to 1.7.0-8.

Note that the patch also adds a length check before reading
key.dptr[strlen(user)] in the key_only loop, which the old code read
without checking the key length.

Regards,
automationcanadian