CVE-2026-3184 Util-linux: util-linux: access control bypass due to improper hostname canonicalization

Low 3.7 Published 3 Apr 2026 Updated 31 Aug 2026

Attackers can bypass PAM host-based access controls by exploiting improper hostname canonicalization in the login utility, potentially gaining unauthorized access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-3184?

CVE-2026-3184 is a low-severity authentication bypass vulnerability in Redhat Hardened Images, published on 3 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.

Weakness: CWE-289

Which versions are affected by CVE-2026-3184?

It affects 2 products.

Linux distribution packages (26)

`util-linux` SUSE:Linux Enterprise Micro 5.2	All versions	`2.36.2-150300.4.53.1`
`util-linux` SUSE:Linux Enterprise Micro 5.2	All versions	`2.36.2-150300.4.58.1`
`util-linux-systemd` SUSE:Linux Enterprise Micro 5.2	All versions	`2.36.2-150300.4.53.1`
`util-linux-systemd` SUSE:Linux Enterprise Micro 5.2	All versions	`2.36.2-150300.4.58.1`
`util-linux` SUSE:Linux Enterprise Micro 5.3	All versions	`2.37.2-150400.8.41.1`
`util-linux-systemd` SUSE:Linux Enterprise Micro 5.3	All versions	`2.37.2-150400.8.41.1`
`util-linux` SUSE:Linux Enterprise Micro 5.4	All versions	`2.37.2-150400.8.41.1`
`util-linux-systemd` SUSE:Linux Enterprise Micro 5.4	All versions	`2.37.2-150400.8.41.1`
`util-linux` SUSE:Linux Enterprise Micro 5.5	All versions	`2.37.4-150500.9.23.1`
`util-linux-systemd` SUSE:Linux Enterprise Micro 5.5	All versions	`2.37.4-150500.9.23.1`
`util-linux` SUSE:Linux Enterprise Module for Basesystem 15 SP7	All versions	`2.40.4-150700.4.10.1`
`util-linux-systemd` SUSE:Linux Enterprise Module for Basesystem 15 SP7	All versions	`2.40.4-150700.4.10.1`
`util-linux-systemd` SUSE:Linux Enterprise Module for Server Applications 15 SP7	All versions	`2.40.4-150700.4.10.1`
`python-libmount` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	All versions	`2.33.2-4.51.2`
`util-linux` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	All versions	`2.33.2-4.51.1`
`util-linux-systemd` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	All versions	`2.33.2-4.51.1`
`util-linux` SUSE:Linux Micro 6.0	All versions	`2.39.3-5.1`
`util-linux-systemd` SUSE:Linux Micro 6.0	All versions	`2.39.3-5.1`
`util-linux` SUSE:Linux Micro 6.1	All versions	`2.40.4-slfo.1.1_4.1`
`util-linux-systemd` SUSE:Linux Micro 6.1	All versions	`2.40.4-slfo.1.1_4.1`
`python-libmount` openSUSE:Leap 15.6	All versions	`2.39.3-150600.4.18.1`
`python3-libmount` openSUSE:Leap 15.6	All versions	`2.37.4-150500.9.23.1`
`util-linux` openSUSE:Leap 15.6	All versions	`2.37.4-150500.9.23.1`
`util-linux` openSUSE:Leap 15.6	All versions	`2.39.3-150600.4.18.1`
`util-linux-systemd` openSUSE:Leap 15.6	All versions	`2.39.3-150600.4.18.1`
`util-linux` openSUSE:Tumbleweed	All versions	`2.41.3-4.1`

Products include Kernel Util-Linux, Redhat Hardened Images.

How do I fix CVE-2026-3184?

Apply the vendor's patch.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-3184 being exploited?

There is no known exploitation of CVE-2026-3184 in the wild and no public exploit code.

All Redhat Hardened Images vulnerabilities

Sources

Also known as AZL-81911, BELL-CVE-2026-3184, DEBIAN-CVE-2026-3184, ECHO-783b-c2ac-c763, GHSA-qp7r-5rpf-pwxg, OESA-2026-1532 and 20 more.