EUVD-2026-37924Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local attack vector and low-privilege prerequisite confirmed by description; no confidentiality or integrity impact; availability High because crash can block all service authentication.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_loginctl_local() can cause a NULL dereference crash when parsing loginctl output. The function calls popen() and reads the result; if the Remote field is only a newline, fgets() succeeds but strtok_r(buf, "\n", &saveptr) returns NULL. A subsequent strcmp(is_remote, "no") then dereferences NULL, causing undefined behavior (typically SIGSEGV) and crashing the PAM module. This can crash the authenticating process (e.g., sudo, login) and, depending on PAM stack configuration, deny access for all users of the affected service. This issue has been fixed in version 0.9.2.
AnalysisAI
NULL pointer dereference in pam_usb 0.9.1 and below crashes PAM-integrated authentication services (sudo, login) when loginctl returns an empty Remote field during session locality checks. The crash terminates the PAM module with SIGSEGV, and depending on PAM stack control flags (required vs. optional), can deny authentication to all users of the affected service - a local denial of service with potentially severe impact on system accessibility. No active exploitation confirmed (not in CISA KEV); vendor-released patch available in version 0.9.2, which also addresses 11 additional security findings discovered during an ongoing audit.
Technical ContextAI
pam_usb is a Linux PAM (Pluggable Authentication Modules) library that enables hardware-based authentication using removable USB media, identified by CPE cpe:2.3:a:mcdope:pam_usb:*:*:*:*:*:*:*:*. The vulnerable function pusb_is_loginctl_local() invokes loginctl via popen() to determine whether a session is local or remote. The root cause (CWE-476: NULL Pointer Dereference) is an unhandled edge case: when loginctl returns a Remote field containing only a newline character, fgets() reads the line successfully but strtok_r(buf, "\n", &saveptr) finds no non-delimiter token and returns NULL. The code then passes this NULL pointer directly to strcmp(is_remote, "no"), which dereferences it - causing undefined behavior, typically manifesting as SIGSEGV. Because pam_usb operates inside privileged PAM context (sudo, login, su), the crash propagates to those processes. The fix in 0.9.2 adds a NULL check on the strtok_r return value before proceeding.
RemediationAI
Upgrade to pam_usb version 0.9.2, which fixes this NULL dereference (commit #393 in the release) alongside 11 other security findings including XXE, TOCTOU races, symlink attacks, and environment variable injection. The release is available at https://github.com/mcdope/pam_usb/releases/tag/0.9.2 and the vendor strongly recommends upgrading. If immediate upgrade is not feasible, set the pam_usb PAM stack control flag to optional rather than required for affected services (sudo, login); this prevents a crash in the module from blocking the entire authentication chain, though it reduces the security guarantee that USB media presence is enforced. Note this workaround changes the security posture: authentication will proceed even if pam_usb fails entirely, defeating the hardware authentication purpose. A more conservative workaround is to temporarily remove pam_usb from the PAM stack for critical services until patching is complete, accepting loss of USB hardware authentication as a trade-off against availability risk.
Authentication bypass in pam_usb before 0.9.1 allows remote unauthenticated attackers to reach the USB hardware-authenti
Authentication bypass in pam_usb prior to 0.9.0 lets a local user defeat the USB hardware-authentication factor by delet
Heap buffer overflow in pam_usb prior to 0.9.1 allows a local attacker with high privileges to corrupt heap memory on 32
XXE injection in pam_usb prior to 0.9.2 enables an attacker with write access to the root-owned configuration file to tr
XPath injection in pam_usb prior to 0.9.0 allows unauthenticated remote attackers to manipulate device-verification quer
PATH hijacking in pam_usb helper tools prior to version 0.9.0 allows a local low-privileged attacker who can manipulate
Environment variable injection in pam_usb prior to version 0.9.2 allows a local authenticated user to bypass hardware US
Symlink race condition in pam_usb prior to 0.9.2 allows a local attacker to redirect one-time pad files to an attacker-c
Non-atomic one-time pad file creation in pam_usb prior to 0.9.2 exposes the core replay-prevention mechanism to a local
Concurrent PAM invocations in pam_usb prior to 0.9.1 expose a process-wide static pointer race condition in src/log.c, w
Infinite loop denial-of-service in pam_usb 0.9.1 and earlier can permanently hang authentication processes such as sudo,
Insecure deallocation in pam_usb 0.9.1 and below leaves sensitive authentication material - including one-time pad (OTP)
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today