Does that actually fix it? The linked email listing says the issue is that logging in as a non-existent user with an empty password will work, and the fix that you linked seems to just make it harder to figure out if a user doesn't exist. That doesn't seem like it fixes anything; there's no need to determine beforehand if a user doesn't exist to use this exploit, since you could just try to use the exploit with an arbitrary username, and if it works, then obviously the user doesn't exist.

I wonder if I should create a "pam_unix_non_existent:" account.

I hate to be that guy, but _damn_ does PAM seem ripe for being rewritten in Rust. Maybe it's the PTSD speaking, but seeing vanilla C string operations in a security-critical library makes my hair stand on end.

Searching around, the best I can find is one 0.1 crate that hasn't seen activity since 2017:

https://crates.io/crates/librustpam