CVE-2010-4706: The pam_sm_close_session function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and e...

Security readout for executives and security teams

This CVE describes a Linux-PAM pam_xauth flaw where closing a session can mishandle an undetermined target user ID. A local user may be able to cause unintended file deletion through software that uses the pam_xauth PAM check. The sources do not show remote exposure or confirmed active exploitation. Exposure is most likely on Unix/Linux systems with Linux-PAM 1.1.2 or earlier where pam_xauth is enabled in PAM service configuration. Risk depends on local account access and use of programs that invoke pam_xauth during session handling. Treat this as a targeted hygiene issue for older Linux estates, especially shared servers. It is not evidenced as internet-exploitable or actively exploited, but unintended file deletion on multi-user systems can disrupt operations and should be closed through normal patch governance. Mitigation focus: Inventory systems running Linux-PAM 1.1.2 or earlier.; Check distribution advisories for fixed PAM package versions.; Update Linux-PAM or pam packages through supported vendor channels..

Prepared

Jun 27, 2026, 18:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.