CVE-2026-44713 Details

A command injection vulnerability has been identified in pam_usb versions prior to 0.8.7, specifically within the tmux integration. The issue arises in src/tmux.c, where the user's $TMUX environment variable is read, split on commas, and the socket-path component is directly interpolated into a shell command executed by popen(). This interpolation occurs without proper sanitization, allowing any value containing a double quote to terminate the quoted string and inject arbitrary shell commands. The popen() function is executed with root privileges in the PAM stack, creating a significant security risk. Exploitation of this vulnerability allows local users to bypass USB authentication and gain unauthorized root access.

Users can update to pam_usb version 0.8.7 or later, where this vulnerability has been fixed. The updated version validates the $TMUX socket path and client ID to reject values containing shell metacharacters before constructing commands. Additionally, the 'w' command is now executed via its full path to prevent similar injection issues.