PT-2026-50770 · Mcdope · Pam Usb

Published 2026-06-18 · Updated 2026-06-18 · CVE-2026-48985

Mitre

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

pam usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb is loginctl local() can cause a NULL dereference crash when parsing loginctl output. The function calls popen() and reads the result; if the Remote field is only a newline, fgets() succeeds but strtok r(buf, " ", &saveptr) returns NULL. A subsequent strcmp(is remote, "no") then dereferences NULL, causing undefined behavior (typically SIGSEGV) and crashing the PAM module. This can crash the authenticating process (e.g., sudo, login) and, depending on PAM stack configuration, deny access for all users of the affected service. This issue has been fixed in version 0.9.2.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-48985

Affected Products

Pam Usb

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-48985 · Security Note
• https://github.com/mcdope/pam_usb/security/advisories/GHSA-7j6h-wfc2-mg5q · Note
• https://github.com/mcdope/pam_usb/releases/tag/0.9.2 · Note