linux-pam: apply patch for CVE-2025-6020

pkgs/by-name/li/linux-pam/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   buildPackages,
   fetchurl,
+  fetchpatch,
   flex,
   db4,
   gettext,
@@ -24,6 +25,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./suid-wrapper-path.patch
+    # required for fixing CVE-2025-6020
+    (fetchpatch {
+      url = "https://github.com/linux-pam/linux-pam/commit/10b80543807e3fc5af5f8bcfd8bb6e219bb3cecc.patch";
+      hash = "sha256-VS3D3wUbDxDXRriIuEvvgeZixzDA58EfiLygfFeisGg=";
+    })
+    # Manually cherry-picked from 475bd60c552b98c7eddb3270b0b4196847c0072e
+    ./CVE-2025-6020.patch
   ];
 
   # Case-insensitivity workaround for https://github.com/linux-pam/linux-pam/issues/569