CVE-2026-47269
HighSummary
In versions prior to 0.9.0, the deny_remote feature in pam_usb incorrectly checked whether an authentication request originated from a remote session, allowing security bypass. An attacker with physical access to a registered USB device could authenticate over SSH as if they were locally connected.
Risk Assessment
Organizations may be exposed to unauthorized access to systems if an attacker gains physical access to a registered USB device. This poses a serious threat to data and system security.
Recommendation
It is recommended to update pam_usb to version 0.9.0 or later to fix this vulnerability. Additionally, consider implementing further security measures, such as restricting physical access to USB devices.
Original NVD description (English source)
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb's deny_remote feature checks utmpx ut_addr_v6 to detect whether an authentication request originates from a remote session. The outer guard was if (utent->ut_addr_v6[0] != 0), which only tests the first 32-bit word of the 128-bit address field. IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) store the IPv4 address in ut_addr_v6[3] with ut_addr_v6[0] == 0. On systems where the SSH daemon listens on :: (IPv6 wildcard) with AddressFamily any -- common on Ubuntu and Debian -- incoming IPv4 connections are recorded in utmpx as IPv4-mapped IPv6 addresses. The outer check evaluates to false, the remote-detection block is skipped entirely, and the session is treated as local. deny_remote=true does not block the authentication. An attacker with physical access to a registered USB device can authenticate over SSH on an affected system as if they were sitting at a local terminal, bypassing the