PT-2026-50771 · Pam Usb · Pam Usb

Mcdope · CVE-2026-48986 · Published 2026-06-18 · Updated 2026-06-22

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions pam usb versions prior to 0.9.2

Description An infinite loop Denial of Service (DoS) occurs during the process-tree walk when a parent process exits during authentication. The function usb get process parent id() fails to initialize the *ppid variable upon failure. In the pusb local login() function, this variable is reused as both input and output within a while loop; if the system cannot read /proc/<pid>/stat, the PID is not updated, preventing the loop from terminating. This results in the authentication process, such as sudo, sshd, or login, hanging until it is forcibly terminated.

Recommendations Update to version 0.9.2.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-48986

GHSA-H28H-9HC3-V595

Affected Products

Pam Usb

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48986.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-48986 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48986 · Security Note
• https://github.com/mcdope/pam_usb/security/advisories/GHSA-h28h-9hc3-v595 · Note
• https://github.com/mcdope/pam_usb/releases/tag/0.9.2 · Note
• https://t.me/CVEtracker/57280 · Telegram Post
• https://t.me/cveNotify/171802 · Telegram Post
• https://t.me/cveNotify/170648 · Telegram Post
• https://t.me/cveNotify/171484 · Telegram Post