CVE-2026-48983 Details
Description
pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, a symlink race condition exists in per-device and per-user pad directory creation. pam_usb uses a check-then-act pattern: it calls lstat() to test for existence and then calls mkdir() separately to create the directory. A local attacker can win the race between these calls by replacing the target path with a symlink to a directory they control. If successful, one-time pad files may be written to an attacker-controlled location, potentially exposing future pad values before use or disrupting authentication. This issue has been fixed in version 0.9.2.
A symlink race condition vulnerability has been identified in pam_usb versions prior to 0.9.2. The issue arises during the creation of per-device and per-user pad directories, where a check-then-act pattern is used. A local attacker can exploit this by replacing the target path with a symlink to a directory they control, potentially leading to unauthorized access to one-time pad files or disruption of the authentication process.
Users are advised to upgrade to pam_usb version 0.9.2, which addresses the vulnerability by fixing the race condition in pad directory creation. The updated version is available on the GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 18, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mcdope/pam_usb/releases/tag/0.9.2 | [email protected] | Release NotesVendor |
| https://github.com/mcdope/pam_usb/security/advisories/GHSA-4j8q-67fq-3xc3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mcdope pam_usb | <= 0.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 18, 2026 | New CVE Received | [email protected] |