The flaw lies in the pam_usb module's static pointer in src/log.c, which is overwritten on each PAM invocation with a stack‑local address. Because this pointer is shared process‑wide and the module is called concurrently by multiple threads, the requirement that PAM modules be re‑entrant is violated. The resulting data race can cause inconsistent writes to the pointer, potentially leading to authentication failures or, under rare circumstances, to an unauthorized access if the race is exploited to alter authentication logic.

This issue affects the pam_usb implementation from the mcdope project. All releases prior to 0.9.1 contain the buggy static pointer. The fix is included in 0.9.1 and later.

The CVSS score of 5.7 rates the vulnerability as medium, reflecting the potential for authentication disruption but limited exploitability. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is concurrent authentication requests through a PAM stack, which would require either local or privileged access or the cooperation of another process that can trigger simultaneous calls. As the description does not specify that the race can reliably cause a denial of service or bypass, we treat it as medium risk until a proof of concept is demonstrated.