A flaw inside the util‑linux package, specifically the login utility when run with the -h option, improperly canonicalizes the hostname supplied by the user. The altered hostname is then used to set the PAM_RHOST environment variable, potentially causing host‑based Pluggable Authentication Modules to evaluate an incorrect fully qualified domain name. Attackers can craft a hostname that bypasses PAM access control rules, leading to unauthorized authentication or privilege escalation. This weakness is categorized as improper authorization (CWE‑289). The impact is limited to gaining authentication privileges; it does not provide arbitrary code execution or denial of service.

The vulnerability affects Red Hat products: Red Hat Enterprise Linux 7 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. Any instance of these operating systems or container runtimes that run login with the -h option is potentially exposed.

The CVSS score of 3.7 indicates a low severity, and the EPSS score is below 1 %, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Since the flaw allows an attacker to influence the hostname used for authentication, the practical attack vector requires remote access to the system to invoke login with the -h option and supply the crafted hostname. No known public exploits exist, so the risk remains low to moderate under current conditions.