CVE-2026-44709 Details

A vulnerability in pam_usb versions prior to 0.8.7 allows for arbitrary command execution. The issue arises in the pamusb-pinentry tool, which executes the PINENTRY_FALLBACK_APP environment variable without validation. This flaw can be exploited by any process that sets environment variables before pamusb-pinentry is called, directing PINENTRY_FALLBACK_APP to an arbitrary binary or script that is then executed with the privileges of the pam_usb tool chain. Additionally, in versions prior to 0.8.7, the GNOME Keyring unlock password was exposed in process arguments, briefly visible to other local users.

Users can update to pam_usb version 0.8.7 or later, where this vulnerability has been fixed. In the patched version, pamusb-pinentry validates the PINENTRY_FALLBACK_APP variable to ensure it points to an existing executable file before execution. The GNOME Keyring integration has also been updated to prevent password exposure in process arguments.