PT-2026-50771 · Mcdope · Pam Usb

Publicado 2026-06-18 · Atualizado 2026-06-18 · CVE-2026-48986

Mitre

CVSS v3.1

4.7

Média

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

pam usb provides hardware authentication for Linux using removable media. In pam usb 0.9.1 and earlier, usb get process parent id() can cause an infinite loop DoS because it does not initialize *ppid on failure. In pusb local login(), the same variable is reused as input and output in a process-tree while loop; if /proc//stat cannot be read (for example, when an ancestor process exits during authentication), the PID is not updated and the loop does not terminate. This hangs the authenticating process (such as sudo, sshd, or login) until it is forcibly terminated. This issue has been fixed in version 0.9.2.

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2026-48986

Produtos afetados

Pam Usb

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-48986 · Nota de Segurança
• https://github.com/mcdope/pam_usb/security/advisories/GHSA-h28h-9hc3-v595 · Nota
• https://github.com/mcdope/pam_usb/releases/tag/0.9.2 · Nota