Read the docs
TI-2026-36241 Aliases CVE-2026-48985

pam_usb: NULL Dereference Crash in pusb_is_loginctl_local when loginctl Returns Empty Remote Field

Priority LOW 24CWE-476Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_loginctl_local() can cause a NULL dereference crash when parsing loginctl output. The function calls popen() and reads the result; if the Remote field is only a newline, fgets() succeeds but strtok_r(buf, "\n", &saveptr) returns NULL. A subsequent strcmp(is_remote, "no") then dereferences NULL, causing undefined behavior (typically SIGSEGV) and crashing the PAM module. This can crash the authenticating process (e.g., sudo, login) and, depending on PAM stack configuration, deny access for all users of the affected service. This issue has been fixed in version 0.9.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00164 5th percentileScored 2026-11-07
Fix Fixed pam_usb (mcdope): 0.9.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mcdopepam_usbbefore 0.9.20.9.2Patch availableCNA
  • pam_usb Vendormcdope Affected before 0.9.2 Fixed in 0.9.2 Patch available CNA

Remediation

  • Fix · CNA pam_usb (mcdope) Fixed in 0.9.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48985

References

Other 2

  • TI-2026-35505 pam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypass CVSS 3.1HIGH 8.1
  • TI-2026-32598 pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption CVSS 3.1HIGH 7.9
  • TI-2026-32596 pam_usb: PINENTRY_FALLBACK_APP environment variable allows arbitrary command execution CVSS 3.1HIGH 7.8
  • TI-2026-32600 pam_usb: Command injection via $TMUX environment variable leads to RCE as root CVSS 3.1HIGH 8.8
  • TI-2026-32599 pam_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agent CVSS 3.1HIGH 8.2
  • TI-2026-34849 pam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as local CVSS 3.1HIGH 7.4
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences