PT-2026-44084 · Pam Usb · Pam Usb

Mcdope · Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-47271

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions pam usb versions prior to 0.9.0

Description In src/mem.c, out-of-memory guards for the functions xmalloc(), xrealloc(), and xstrdup() were implemented using assert(data != NULL). Because assert() expressions are compiled out when NDEBUG is defined during build time—a common practice in release and packaging builds for Debian, Fedora, and Arch—these guards are removed in such versions. Consequently, these functions return NULL upon allocation failure, which is then dereferenced without a check, leading to a NULL pointer dereference and a crash of the PAM module. This creates a local denial-of-service condition where an attacker inducing memory pressure during authentication can lock all users out of sudo and login.

Recommendations Update to version 0.9.0.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-47271

Affected Products

Pam Usb

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-47271 · Security Note
• https://github.com/mcdope/pam_usb/security/advisories/GHSA-7rvx-jcc6-7hqq · Note
• https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd · Note
• https://t.me/CVEtracker/55171 · Telegram Post