CVE-2026-3184: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-3184 is an authentication bypass vulnerability in the login(1) utility of util-linux, caused by improper hostname canonicalization when the -h option is used. When invoked with a specially crafted hostname, the utility may modify the supplied remote hostname before setting PAM_RHOST, potentially allowing an attacker to bypass host-based PAM access control rules that rely on fully qualified domain names (FQDNs). The vulnerability was first reported on February 25, 2026, and published to NVD on April 3, 2026. Affected products include util-linux (all versions with the vulnerable login(1) behavior), Microsoft Azure Linux 3 packages azl3_util-linux_2.40.2-3 and azl3_util-linux_2.40.2-4, and Red Hat Hardened Images. It carries a CVSS v3.1 base score of 5.3 (Medium) per Feedly/NVD, though ENISA rates it 3.7 (Red Hat CVE, Red Hat Bugzilla, Microsoft MSRC).

The root cause is classified as CWE-289 (Authentication Bypass by Alternate Name). The login(1) utility, when called with the -h <hostname> option (as done by telnet/rlogin-style daemons or custom wrappers), performs improper hostname canonicalization that can transform the attacker-supplied hostname before it is assigned to PAM_RHOST. PAM modules such as pam_access that make authorization decisions based on PAM_RHOST and rely on FQDNs may then incorrectly grant access if the canonicalized hostname matches an allowed entry. Exploitation requires three conditions: the attacker must reach a remote login pathway that invokes login(1) with -h; the target system must use PAM modules relying on PAM_RHOST for authorization; and the local system's hostname must share the same domain suffix as the attacker-supplied hostname (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows a remote, unauthenticated attacker to bypass host-based PAM access control rules, potentially gaining unauthorized access to systems that restrict logins by hostname or FQDN. The primary impact is an integrity violation — specifically, unauthorized login access — with no direct confidentiality or availability impact identified. The scope is limited to systems using PAM modules (e.g., pam_access) configured with FQDN-based rules and exposing legacy remote login services such as telnet or rlogin (Red Hat Bugzilla, Red Hat CVE).

1. Reconnaissance: Identify target systems running legacy remote login services (e.g., telnet, rlogin, or custom wrappers) that invoke login(1) with the -h option, and confirm the system uses PAM with pam_access or similar modules configured with FQDN-based allow/deny rules.
2. Identify domain suffix: Determine the local hostname's domain suffix on the target system (e.g., via DNS enumeration or banner information), as the attacker-supplied hostname must share this suffix to trigger the canonicalization behavior.
3. Craft malicious hostname: Construct a specially crafted hostname that, after improper canonicalization by login(1), resolves to a hostname permitted by the target's PAM access rules (e.g., supplying a short hostname that gets expanded to match an allowed FQDN).
4. Initiate remote login: Connect to the target via the exposed remote login service and supply the crafted hostname as the -h argument, causing login(1) to set PAM_RHOST to the canonicalized (attacker-controlled) value.
5. Bypass PAM access control: With PAM_RHOST set to the manipulated hostname, PAM modules evaluate the access rules against the crafted value rather than the true remote host, potentially granting unauthorized access (Red Hat Bugzilla).

• Logs: Authentication log entries (/var/log/auth.log or /var/log/secure) showing successful logins from unexpected remote hosts or hostnames that appear to be FQDNs matching internal naming conventions but originating from external IPs.
• Logs: PAM log entries recording PAM_RHOST values that do not match the actual connecting IP address's reverse DNS resolution.
• Network: Inbound connections on telnet (TCP/23) or rlogin (TCP/513) ports from unexpected or external IP addresses, especially if these services are not normally exposed.
• Process: Invocations of login with the -h flag from daemon processes (e.g., telnetd, rlogind) with unusual or crafted hostname arguments visible in process audit logs (e.g., via auditd or execve syscall tracing).

A patch is available via Red Hat Security Advisory RHSA-2026:7180 for Red Hat Hardened Images, and Microsoft has released an update for Azure Linux 3 (azl3_util-linux) addressing this issue (Red Hat Errata, Microsoft MSRC). As a workaround, administrators should disable or restrict access to legacy remote login services (telnet, rlogin) that invoke login(1) with the -h option, as these are the primary attack surface. Additionally, PAM configurations should be reviewed to avoid sole reliance on PAM_RHOST-based FQDN rules for access control; supplementing with IP-based restrictions provides a more robust defense.

The vulnerability received coverage from Linux security news outlets including LinuxSecurity.com and openSUSE security announcements, with SUSE releasing multiple security updates for util-linux addressing this CVE. German Linux security site pro-linux.de published several advisories tracking the issue across different distributions. The Yocto Project security mailing list also discussed the vulnerability in the context of embedded Linux builds. Overall community reaction has been measured, reflecting the moderate severity and limited exploitation conditions required.