CVE-2026-48986

In versions prior to 0.9.2, pam_usb has a symlink race condition in per-device and per-user pad directory creation. A local attacker can exploit this vulnerability by replacing the target path with a symlink to a directory they control.

In versions prior to 0.9.2, pam_usb calls xmlReadFile() with flags=0 when loading the configuration file, allowing libxml2 to process external entity references (XXE). This can lead to outbound network connections or local file reads at XML parse time from the context of the authenticating process.

In versions prior to 0.9.2, the pam_usb module, responsible for hardware authentication on Linux, is vulnerable to environment variable injection. The XRDP_SESSION, DISPLAY, and TMUX variables can be manipulated by a local user, affecting the local and remote session checking logic.

In versions 0.9.1 and below, the pam_usb module can cause a NULL dereference crash when parsing loginctl output. The pusb_is_loginctl_local() function calls popen() and reads the result, which can lead to undefined behavior and crashing the PAM module.

In versions 0.9.1 and below, the xfree() function in pam_usb releases memory without first zeroing the buffer contents, leading to the exposure of sensitive data in freed memory. This could allow recovery of pad values or other authentication material from freed memory regions.

In versions prior to 0.9.0, the deny_remote feature in pam_usb incorrectly checked whether an authentication request originated from a remote session, allowing security bypass. An attacker with physical access to a registered USB device could authenticate over SSH as if they were locally connected.

In versions prior to 0.8.7, pam_usb reads the user's $TMUX environment variable and interpolates its value without proper sanitization, allowing arbitrary shell syntax injection. This creates a risk of unauthorized command execution as root.

pam_usb prior to version 0.8.7 allows remote code execution (RCE) as root through a crafted UUID in the configuration. Running pamusb-conf --reset-pads with such a UUID leads to exploitation of the vulnerability.

pam_usb prior to version 0.8.7 is vulnerable to symlink attacks that allow authentication bypass and root file corruption. Version 0.8.7 includes a fix for this vulnerability.

In versions prior to 0.9.0, the pusb_pad_compare() function in pam_usb did not enforce the presence and readability of the pad file on the USB device, allowing users to authenticate without the physical device. A user could delete their ~/.pamusb/device.pad, resulting in successful authentication without the required USB device.