CVE-2025-14104: 
Rocky Linux vulnerability analysis and mitigation

CVE-2025-14104 is a heap buffer overread vulnerability in util-linux affecting the setpwnam() function within the login-utils component. The flaw occurs when processing usernames exactly 256 bytes in length: the function allocates a 256-byte buffer but accesses linebuf[256] (one byte past the end), triggering an out-of-bounds read. It affects any SUID (Set User ID) login-utils utility that writes to the password database, and the bug originates in code dating back to 1997, meaning all older versions of util-linux are affected. The vulnerability was disclosed on December 5, 2025, and has a CVSS v3.1 base score of 6.1 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read). The setpwnam() function in util-linux's login-utils allocates a fixed 256-byte heap buffer (linebuf) for processing password database entries, but when a username is exactly 256 characters long, the code accesses linebuf[256] — one byte beyond the allocated buffer boundary — resulting in a heap buffer overread. Exploitation requires local access with low privileges and no user interaction; the attacker must be able to invoke a SUID login-utils utility (such as chfn or chsh) with a crafted 256-byte username. The attack vector is local (AV:L), with low attack complexity and low privilege requirements (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows a local low-privileged user to read sensitive heap memory contents adjacent to the overread buffer, potentially exposing password database data or other sensitive in-memory information (low confidentiality impact). The overread can also cause the SUID login utility to crash, resulting in a denial of service for authentication-related operations (high availability impact). There is no integrity impact, and the scope is unchanged, limiting the blast radius to the affected system without direct lateral movement capability (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported.

The upstream fix was released in util-linux v2.41.3 and backported to Fedora 43 and 42 (util-linux-2.40.4-8.fc42) in December 2025 (Red Hat Bugzilla). Red Hat issued security advisories addressing the flaw across RHEL 8 (RHSA-2026:1852), RHEL 9 (RHSA-2026:1913), and RHEL 10 (RHSA-2026:1696), with patched packages such as util-linux-2.40.2-15.el10_1 (Red Hat RHSA-2026:1696). Additional vendor patches have been released by Microsoft (CBL-Mariner/AZL), SUSE, Oracle (April 2026 CPU), IBM (Netezza Appliance, Cloud Pak for AIOps, API Connect, Cloud Pak for Business Automation, Business Automation Insights), and Splunk AppDynamics (Oracle CPU Apr 2026). As a workaround where patching is not immediately possible, restrict access to SUID login utilities (e.g., chfn, chsh) to trusted users only, and monitor for attempts to invoke these utilities with unusually long usernames.

Karel Zak, the upstream util-linux maintainer, confirmed the fix in upstream release v2.41.3 and noted the bug originated in code from 1997, making all older versions affected (Red Hat Bugzilla). Community members raised concerns about the delay in backporting the fix to CentOS Stream 9, noting a gap of over 13 months between CVE disclosure and patch availability for some distributions. The vulnerability received routine coverage from Linux security news outlets and distribution security trackers (Fedora, SUSE, AlmaLinux, Rocky Linux, Oracle Linux), but did not generate significant broader media attention given its moderate severity and local-only attack vector.