PT-2026-50771 · Mcdope · Pam Usb

Published 2026-06-18 · Updated 2026-06-18 · CVE-2026-48986

NVD

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

pam usb provides hardware authentication for Linux using removable media. In pam usb 0.9.1 and earlier, usb get process parent id() can cause an infinite loop DoS because it does not initialize *ppid on failure. In pusb local login(), the same variable is reused as input and output in a process-tree while loop; if /proc//stat cannot be read (for example, when an ancestor process exits during authentication), the PID is not updated and the loop does not terminate. This hangs the authenticating process (such as sudo, sshd, or login) until it is forcibly terminated. This issue has been fixed in version 0.9.2.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-48986

Affected Products

Pam Usb

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-48986 · Security Note
• https://github.com/mcdope/pam_usb/security/advisories/GHSA-h28h-9hc3-v595 · Note
• https://github.com/mcdope/pam_usb/releases/tag/0.9.2 · Note