CVE-2026-44710 Details
Description
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model() directly to strcmp() without NULL checks. The GIO/UDisks API documentation states these accessors can return NULL for devices that do not expose the corresponding field. Passing NULL to strcmp() is undefined behaviour (typically a SIGSEGV). This vulnerability is fixed in 0.8.7.
A NULL pointer dereference vulnerability has been identified in pam_usb versions prior to 0.8.7. The issue arises in src/device.c, where the return values of udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model() are passed directly to strcmp() without checking for NULL. According to the GIO/UDisks API documentation, these accessors can return NULL for devices that do not provide the corresponding information. Passing NULL to strcmp() results in undefined behavior, typically causing a segmentation fault (SIGSEGV). This vulnerability can be exploited by an attacker with physical access who connects a USB device or mass-storage gadget that does not expose a serial number via UDisks. The PAM module crashes during device enumeration, leading to authentication failures for all users on the affected service until the device is removed. On a single-user workstation with pam_usb configured for login, this causes a complete lockout.
Users can upgrade to pam_usb version 0.8.7 or later, where this vulnerability has been fixed. The update is available on the GitHub repository for pam_usb.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mcdope/pam_usb/security/advisories/GHSA-j8cq-2gv6-gfwf | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mcdope pam_usb | <= 0.8.6 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |