EUVD-2026-32648Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Lifecycle Timeline
3DescriptionGitHub Advisory
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/log.c contains a process-wide static pointer that is written on every PAM invocation with the address of a stack-local variable. This violates the PAM re-entrancy requirement and creates a data race when the PAM stack is invoked concurrently from multiple threads. This vulnerability is fixed in 0.9.1.
AnalysisAI
Concurrent PAM invocations in pam_usb prior to 0.9.1 expose a process-wide static pointer race condition in src/log.c, where each PAM call overwrites a shared static pointer with the address of a stack-local variable. When multiple threads invoke the PAM stack simultaneously - a normal condition in multi-threaded Linux services such as SSH daemons or display managers - one thread's logging pointer can reference another thread's already-deallocated stack frame, causing availability loss (crash/hang) or limited integrity corruption. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
Technical ContextAI
pam_usb (CPE: cpe:2.3:a:mcdope:pam_usb:*:*:*:*:*:*:*:*) is a Linux PAM module that enforces hardware two-factor authentication using removable USB media. The PAM framework mandates that modules be re-entrant and thread-safe, as calling applications such as sshd or polkit may invoke the PAM stack concurrently from multiple threads. The root cause (CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization) is located in src/log.c, which holds a single process-wide static pointer. On every PAM invocation, this pointer is assigned the address of a variable residing on that invocation's call stack. Because the stack frame is destroyed when the function returns, any concurrent thread that dereferences the static pointer after the originating thread has returned is reading a dangling pointer into freed stack memory. The CVSS vector AV:L/AC:H reflects that exploitation requires local system access and precise timing to trigger the race window.
RemediationAI
Upgrade pam_usb to version 0.9.1, which resolves the static pointer misuse in src/log.c. This is the vendor-released patch per the GitHub Security Advisory GHSA-qg76-57wq-mpv6 at https://github.com/mcdope/pam_usb/security/advisories/GHSA-qg76-57wq-mpv6. If immediate upgrade is not possible, a compensating control is to restrict pam_usb to single-threaded authentication contexts only - for example, disabling concurrent session handling in sshd (setting MaxStartups 1) to eliminate the race window, though this introduces a denial-of-service risk by serializing all SSH authentication. Alternatively, removing pam_usb from the PAM stack of services that invoke PAM concurrently (e.g., commenting out the pam_usb line in /etc/pam.d/sshd) eliminates exposure at the cost of disabling hardware USB authentication for those services. Upgrade to 0.9.1 is the only complete fix.
Authentication bypass in pam_usb before 0.9.1 allows remote unauthenticated attackers to reach the USB hardware-authenti
Authentication bypass in pam_usb prior to 0.9.0 lets a local user defeat the USB hardware-authentication factor by delet
Heap buffer overflow in pam_usb prior to 0.9.1 allows a local attacker with high privileges to corrupt heap memory on 32
XXE injection in pam_usb prior to 0.9.2 enables an attacker with write access to the root-owned configuration file to tr
XPath injection in pam_usb prior to 0.9.0 allows unauthenticated remote attackers to manipulate device-verification quer
PATH hijacking in pam_usb helper tools prior to version 0.9.0 allows a local low-privileged attacker who can manipulate
Environment variable injection in pam_usb prior to version 0.9.2 allows a local authenticated user to bypass hardware US
Symlink race condition in pam_usb prior to 0.9.2 allows a local attacker to redirect one-time pad files to an attacker-c
Non-atomic one-time pad file creation in pam_usb prior to 0.9.2 exposes the core replay-prevention mechanism to a local
NULL pointer dereference in pam_usb 0.9.1 and below crashes PAM-integrated authentication services (sudo, login) when lo
Infinite loop denial-of-service in pam_usb 0.9.1 and earlier can permanently hang authentication processes such as sudo,
Insecure deallocation in pam_usb 0.9.1 and below leaves sensitive authentication material - including one-time pad (OTP)
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today