CVE-2026-48986 Details
Description
pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 and earlier, usb_get_process_parent_id() can cause an infinite loop DoS because it does not initialize *ppid on failure. In pusb_local_login(), the same variable is reused as input and output in a process-tree while loop; if /proc/<pid>/stat cannot be read (for example, when an ancestor process exits during authentication), the PID is not updated and the loop does not terminate. This hangs the authenticating process (such as sudo, sshd, or login) until it is forcibly terminated. This issue has been fixed in version 0.9.2.
A denial-of-service vulnerability has been identified in pam_usb versions through 0.9.1. The issue arises in the function usb_get_process_parent_id(), which can create an infinite loop. This occurs because the function does not properly initialize the process ID variable on failure. When this variable is reused in a loop that traverses the process tree, the loop can become stuck if an ancestor process exits during authentication, preventing the loop from terminating. As a result, the authentication process, such as sudo or ssh, hangs indefinitely until it is forcibly terminated.
Users can upgrade to pam_usb version 0.9.2, which fixes the vulnerability by adding cycle detection to the process-tree walk, preventing a crafted /proc from causing an infinite loop.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 18, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mcdope/pam_usb/releases/tag/0.9.2 | [email protected] | Release NotesVendor |
| https://github.com/mcdope/pam_usb/security/advisories/GHSA-h28h-9hc3-v595 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mcdope pam_usb | <= 0.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 18, 2026 | New CVE Received | [email protected] |