EUVD-2026-37923Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Local-only race condition with timing dependency justifies AV:L and AC:H; existing unprivileged shell required (PR:L); impact is purely availability of the auth process (A:H, C:N, I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 and earlier, usb_get_process_parent_id() can cause an infinite loop DoS because it does not initialize *ppid on failure. In pusb_local_login(), the same variable is reused as input and output in a process-tree while loop; if /proc/<pid>/stat cannot be read (for example, when an ancestor process exits during authentication), the PID is not updated and the loop does not terminate. This hangs the authenticating process (such as sudo, sshd, or login) until it is forcibly terminated. This issue has been fixed in version 0.9.2.
AnalysisAI
Infinite loop denial-of-service in pam_usb 0.9.1 and earlier can permanently hang authentication processes such as sudo, sshd, or login on Linux systems using USB hardware authentication. The flaw is in usb_get_process_parent_id(), which fails to initialize *ppid on failure; pusb_local_login() reuses the same variable as both input and output in a process-tree traversal loop, so if /proc/<pid>/stat becomes unreadable mid-authentication (e.g., an ancestor process exits during the auth window), the PID is never advanced and the loop never terminates. No public exploit has been identified and KEV listing is absent; the vendor-released patch is version 0.9.2, which is strongly recommended given the criticality of the affected authentication stack components.
Technical ContextAI
pam_usb (CPE: cpe:2.3:a:mcdope:pam_usb:*:*:*:*:*:*:*:*) is a Linux Pluggable Authentication Module (PAM) that gates authentication on the presence of a specific USB removable media device, providing hardware-based two-factor authentication for services integrated with PAM such as sudo, sshd, and login. The root cause is CWE-835 (Loop with Unreachable Exit Condition): the loop termination criterion - reaching the process-tree root - can never be satisfied because the variable tracking the current PID is never updated when /proc/<pid>/stat is unreadable. Specifically, usb_get_process_parent_id() returns an error code without writing to *ppid on failure, so pusb_local_login()'s while loop - which feeds the returned ppid back as the next pid to walk - stalls on the same stale PID indefinitely. The fix in 0.9.2 adds explicit cycle detection to the process-tree walk (#394, issue #388).
RemediationAI
Vendor-released patch: 0.9.2. Upgrade pam_usb to version 0.9.2 immediately; the vendor explicitly describes this as a security hardening release and strongly recommends upgrading. Release artifacts and notes are available at https://github.com/mcdope/pam_usb/releases/tag/0.9.2, and the advisory is at https://github.com/mcdope/pam_usb/security/advisories/GHSA-h28h-9hc3-v595. If an immediate upgrade is not feasible, a compensating control is to temporarily remove pam_usb from the PAM stack for critical services (edit /etc/pam.d/sudo, /etc/pam.d/sshd, and /etc/pam.d/login) - note this completely disables USB hardware authentication, removing the second factor. An additional mitigation is to configure PAM's auth timeout or deploy a process watchdog that forcibly terminates hung authentication sessions, limiting the DoS impact to individual sessions rather than an indefinite hang. Neither workaround addresses the root cause.
Authentication bypass in pam_usb before 0.9.1 allows remote unauthenticated attackers to reach the USB hardware-authenti
Authentication bypass in pam_usb prior to 0.9.0 lets a local user defeat the USB hardware-authentication factor by delet
Heap buffer overflow in pam_usb prior to 0.9.1 allows a local attacker with high privileges to corrupt heap memory on 32
XXE injection in pam_usb prior to 0.9.2 enables an attacker with write access to the root-owned configuration file to tr
XPath injection in pam_usb prior to 0.9.0 allows unauthenticated remote attackers to manipulate device-verification quer
PATH hijacking in pam_usb helper tools prior to version 0.9.0 allows a local low-privileged attacker who can manipulate
Environment variable injection in pam_usb prior to version 0.9.2 allows a local authenticated user to bypass hardware US
Symlink race condition in pam_usb prior to 0.9.2 allows a local attacker to redirect one-time pad files to an attacker-c
Non-atomic one-time pad file creation in pam_usb prior to 0.9.2 exposes the core replay-prevention mechanism to a local
Concurrent PAM invocations in pam_usb prior to 0.9.1 expose a process-wide static pointer race condition in src/log.c, w
NULL pointer dereference in pam_usb 0.9.1 and below crashes PAM-integrated authentication services (sudo, login) when lo
Insecure deallocation in pam_usb 0.9.1 and below leaves sensitive authentication material - including one-time pad (OTP)
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today