The vulnerability stems from a race condition in pam_usb’s use of the non‑reentrant strtok() function when multiple concurrent authentication threads run in PAM hosts such as GDM, sudo, or GNOME Shell. Concurrent invocations can overwrite a global tokenisation pointer, leading to corrupted parsing of TMUX and /proc variables used by the deny_remote logic. This corrupted state can cause the PAM module to return an incorrect remote‑session decision—that is, it may inadvertently allow a remote session that should be denied or vice‑versa. Consequently, attackers could potentially bypass remote‑session checks or force a local session to be treated as remote, undermining the intended access controls and permitting unauthorized authentication.

The flaw affects the open‑source pam_usb module developed by mcdope. Versions prior to 0.9.0 are vulnerable. Systems that load pam_usb into PAM hosts—such as sudo, login, GDM, or GNOME Shell—are at risk when those hosts execute authentication in multiple threads. The vulnerability arises only when the deny_remote feature is enabled, so deployments that disable this feature will not be impacted. Users should verify the installed pam_usb version; upgrading to 0.9.0 or later resolves the race condition.

The CVSS score of 6.3 classifies this as a medium‑severity flaw. Because the exploit requires concurrent PAM authentication threads, it is most relevant to multi‑threaded display managers; single‑threaded PAM clients are not affected. The EPSS score is not available, so the likelihood of exploitation cannot be quantified currently, but the lack of a CISA KEV listing suggests it has not yet been exploited in the wild. Nonetheless, the potential for granting unauthorized remote access warrants prompt remediation.