CVE-2026-48980 Details
Description
pam_usb provides hardware authentication for Linux using removable media. In versions prior to 0.9.2, getenv() environment variables XRDP_SESSION, DISPLAY and TMUX allow environment variable injection into local-check logic. These environment variables influence whether a current session is local or remote, and a PAM module that runs in the context of setuid binaries (sudo, su), getenv() returns attacker-controlled values whenever the process environment has been manipulated by a local user. This issue has been fixed in version 0.9.2.
A vulnerability in pam_usb versions prior to 0.9.2 allows environment variable injection into local-check logic of the PAM module. This issue arises because getenv() is used to read environment variables (XRDP_SESSION, DISPLAY, TMUX) that determine whether a session is local or remote. In the context of setuid binaries like sudo and su, getenv() can return values controlled by an attacker if the process environment has been altered by a local user. The vulnerability has been addressed in version 0.9.2 by replacing getenv() with secure_getenv(), which prevents such injection by returning NULL when the effective UID does not match the real UID.
Users can upgrade to pam_usb version 0.9.2, which addresses this vulnerability by replacing getenv() with secure_getenv() in the affected files. The updated version is available on the GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 18, 2026CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mcdope/pam_usb/releases/tag/0.9.2 | [email protected] | Release NotesVendor |
| https://github.com/mcdope/pam_usb/security/advisories/GHSA-qr83-mf3h-fvqr | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-454 | External Initialization of Trusted Variables or Data Stores | [email protected] |
| CWE-807 | Reliance on Untrusted Inputs in a Security Decision | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mcdope pam_usb | <= 0.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 18, 2026 | New CVE Received | [email protected] |