Cybersecurity researchers at Qualys have discovered three serious vulnerabilities in major Linux distributions that allow attackers to gain complete root access to systems. These flaws affect millions of Linux machines worldwide and can be exploited by anyone with basic user access.

## Two-Step Attack Chain Enables Root Access

The most dangerous discovery involves two interconnected vulnerabilities that work together:

**CVE-2025-6018** – A flaw in SUSE 15’s authentication system (PAM) that lets unprivileged users gain “allow_active” status, typically reserved for physically present users.

**CVE-2025-6019** – A vulnerability in libblockdev that allows “allow_active” users to escalate directly to root privileges through the udisks daemon.

“These modern ‘local-to-root’ exploits have collapsed the gap between an ordinary logged-in user and a full system takeover,” explained Saeed Abbasi from Qualys Threat Research Unit. Attackers can chain these vulnerabilities to go from basic user access to complete system control in seconds.

## Widespread Impact Across Linux Distributions

The vulnerabilities affect nearly all major Linux distributions, including:
– Ubuntu
– Debian
– Fedora
– openSUSE Leap 15
– SUSE Linux Enterprise 15

CVE-2025-6019 is particularly concerning because the udisks daemon ships by default on almost all Linux systems, making the vast majority of installations vulnerable.

## Additional PAM Vulnerability Discovered

Separately, Linux PAM maintainers fixed another high-severity flaw:

**CVE-2025-6020** (CVSS score: 7.8) – A path traversal vulnerability in the pam_namespace module that allows local privilege escalation through symlink attacks and race conditions.

This flaw affects Linux PAM versions 1.7.0 and earlier, and has been patched in version 1.7.1.

## Immediate Action Required

**Primary Solution:** Apply security patches from your Linux distribution vendor immediately.

**Temporary Workarounds:**
– For CVE-2025-6018/6019: Modify Polkit rules for “org.freedesktop.udisks2.modify-device” to require administrator authentication
– For CVE-2025-6020: Disable pam_namespace or ensure it doesn’t operate on user-controlled paths

## Why This Matters

Once attackers gain root privileges, they have unlimited system access, enabling them to:
– Install backdoors for persistent access
– Disable security controls
– Access sensitive data
– Use compromised systems as launching points for further attacks

System administrators should prioritize patching these vulnerabilities immediately, as they represent a critical security risk to Linux infrastructure worldwide.