Red Hat libuser race condition CVE-2015-3246 added to CISA's exploited list; RHEL 6 and 7 fixed, RHEL 5 not
A 2015 flaw in Red Hat's libuser (CVE-2015-3246) is now on CISA's exploited list. A local user can corrupt /etc/passwd and gain root. Fixed in RHEL 6 and 7 updates; RHEL 5 has no fix. Server admins should confirm libuser is updated.
Administrators of Red Hat Enterprise Linux 6 or 7 systems, and images or containers built from them, should apply the libuser update from Red Hat. For RHEL 5, which has no fix, retire or isolate the system, or use Red Hat's PAM workaround on the chfn and chsh services.
What’s happening
CISA added CVE-2015-3246 to its list of flaws being used in attacks on 26 August 2026. The flaw is in libuser, a Red Hat library that manages user accounts. It edited the /etc/passwd file in place instead of writing a safe copy and swapping it in, so an interrupted or failed update could leave the file corrupted. A person who already has a login on the machine could use that to crash it or gain full (root) control. Red Hat rates it Important, and the CVE record carries a CVSS score of 7.4. Red Hat says all libuser versions in Red Hat Enterprise Linux (RHEL) 6 and 7 were affected and fixed through RHSA-2015:1482 (RHEL 6) and RHSA-2015:1483 (RHEL 7). RHEL 5 is also affected, but Red Hat says no fix is planned. Container, cloud and appliance images based on these releases can carry the vulnerable library. Red Hat's page does not describe the attacks, and CISA's listing does not say who is exploiting it. This mainly concerns servers and shared systems, not home devices.
- What
- Flaw
- Affects
- Red Hat libuser (Red Hat Enterprise Linux 5, 6 and 7)
- Affected
- All libuser versions in Red Hat Enterprise Linux 6 and 7
Red Hat Enterprise Linux 5 (no fix planned)
Official Red Hat container, Atomic Host, cloud and appliance images and AWS AMIs containing vulnerable libuser
RHEV-H images (fix planned for a future update) - Fixed in
- RHSA-2015:1482 (RHEL 6)
RHSA-2015:1483 (RHEL 7) - Since
- 26 Aug 2026
- Closed
- 26 Aug 2026
Timeline
- CISA added
CISA added CVE-2015-3246 to its Known Exploited Vulnerabilities list, with a federal agency remediation deadline reported as 2026-09-09. The listing does not say who is exploiting it or how widely.
- Made publicPartly fixed
Red Hat's article on CVE-2015-3246 (last updated this date) explains that libuser edited /etc/passwd in place, so a failed update could leave it corrupted. It rates the flaw Important and points to fixes for RHEL 6 (RHSA-2015:1482) and RHEL 7 (RHSA-2015:1483). RHEL 5 is affected but has no fix planned.
Sources
- CVE-2015-3246 libuser race condition (Red Hat)Red Hat · 24 July 2015
- CVE-2015-3246 patch status and CISA KEV listingisitpatched.com · 26 Aug 2026