ZeroDay Findings
Sign inSign up

Findings

CVE-2026-3184

A flaw was found in util-linux.

Published Apr 3, 2026 · updated Aug 31, 2026 · kernel util-linux

A flaw was found in util-linux. Improper hostname canonicalization in the utility, when invoked with the option, can modify the supplied remote hostname before setting . A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 3, 2026 · NIST NVD

    Detected

    A flaw was found in util-linux. Improper hostname canonicalization in the utility, when invoked with the option, can modify the supplied remote hostname before setting . A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lea

  2. Aug 31, 2026 · NIST NVD

    Updated

    A flaw was found in util-linux. Improper hostname canonicalization in the utility, when invoked with the option, can modify the supplied remote hostname before setting . A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lea

Affected

  • cpe kernel/util-linuxversion unspecified
  • cpe redhat/hardened imagesversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-3184

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-3184

    A flaw was found in util-linux. Improper hostname canonicalization in the utility, when invoked with the option, can modify the supplied remote hostname before setting . A remote attacker could exploit this by providing a specially crafted hostname, pot

    nvd.nist.gov

References