CVE-2026-48985 Details
Description
pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_loginctl_local() can cause a NULL dereference crash when parsing loginctl output. The function calls popen() and reads the result; if the Remote field is only a newline, fgets() succeeds but strtok_r(buf, "\n", &saveptr) returns NULL. A subsequent strcmp(is_remote, "no") then dereferences NULL, causing undefined behavior (typically SIGSEGV) and crashing the PAM module. This can crash the authenticating process (e.g., sudo, login) and, depending on PAM stack configuration, deny access for all users of the affected service. This issue has been fixed in version 0.9.2.
A NULL pointer dereference vulnerability has been identified in pam_usb versions through 0.9.1. The issue arises in the function pusb_is_loginctl_local(), which processes output from loginctl. If the Remote field is empty, the function incorrectly handles the response, leading to a NULL dereference. This flaw causes undefined behavior, typically resulting in a segmentation fault that crashes the PAM module. Consequently, the authentication process can fail, potentially denying access to all users for the affected service, depending on the PAM stack configuration.
Users can upgrade to pam_usb version 0.9.2, which addresses this vulnerability by properly handling empty Remote fields in the loginctl output. The updated version is available on the GitHub Releases page for the pam_usb repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 18, 2026CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mcdope/pam_usb/releases/tag/0.9.2 | [email protected] | Release NotesVendor |
| https://github.com/mcdope/pam_usb/security/advisories/GHSA-7j6h-wfc2-mg5q | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mcdope pam_usb | <= 0.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 18, 2026 | New CVE Received | [email protected] |