The vulnerability arises when pam_usb is compiled with the NDEBUG flag, which removes assert‑based out‑of‑memory checks from its memory allocation helpers. When an allocation fails, the helper functions return NULL and the caller dereferences the pointer without checking for null. This causes a crash of the PAM module, interrupting the authentication process performed by sudo or login and effectively denying users access to privileged actions for the duration of the crash.

All releases of the mcdope pam_usb package prior to version 0.9.0 are affected, including the Debian, Fedora, and Arch package builds that compile the module with NDEBUG. The issue is present whenever the module is linked into the PAM stack used for sudo or system logins.

The CVSS score of 5.1 indicates a moderate severity. While the vulnerability does not provide remote code execution, it enables a local denial‑of‑service by allowing an attacker who can impose memory pressure during an authentication attempt to crash the pam_usb module, thereby locking all users out of sudo and login. With no EPSS score available and the vulnerability not listed in CISA’s KEV catalog, the likelihood of widespread exploitation is uncertain but the impact on affected systems remains significant if the module is in use.