CVE-2026-48985

pam_usb: NULL Dereference Crash in pusb_is_loginctl_local when loginctl Returns Empty Remote Field

Published Jun 18, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_loginctl_local() can cause a NULL dereference crash when parsing loginctl output. The function calls popen() and reads the result; if the Remote field is only a newline, fgets() succeeds but strtok_r(buf, "\n", &saveptr) returns NULL. A subsequent strcmp(is_remote, "no") then dereferences NULL, causing undefined behavior (typically SIGSEGV) and crashing the PAM module. This can crash the authenticating process (e.g., sudo, login) and, depending on PAM stack configuration, deny access for all users of the affected service. This issue has been fixed in version 0.9.2.

Analysis

Technical impact

pam_usb is a Linux PAM module that authenticates users using removable media. In versions 0.9.1 and earlier, the function pusb_is_loginctl_local can dereference a NULL pointer when loginctl output contains an empty Remote field. This results in a segmentation fault that terminates the PAM module, and depending on the PAM stack configuration, can deny authentication for all users of the affected service. The vulnerability is a classic NULL pointer dereference (CWE‑476) and can lead to a denial of service on the system.

Affected Systems

Vendors: mcdope provides the pam_usb package. Affected versions are 0.9.1 and all earlier releases. The vulnerability applies to Linux installations that use pam_usb for authentication, such as systems with PAM stacks configured to load the module for login, SSH, sudo, or other privileged services.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is local: an authenticated or unauthenticated user who initiates an authentication session using pam_usb can trigger the crash by providing removable media that causes loginctl to output an empty Remote field. A successful crash would suspend the authentication process, potentially denying service to all users of the affected PAM service. No privileged escalation is required; the impact is limited to denial of service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

mcdope

pam_usb

affected

Version	Status	Constraints
`< 0.9.2`	affected	—

No data.

Vendor Product Versions

Mcdope

Pam Usb

Version	Status	Scheme	Platform
`[0,0.9.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade pam_usb to version 0.9.2 or later, as the issue is fixed there.
Re‑enable any PAM services that rely on pam_usb after the upgrade to verify that authentication works normally.
If an upgrade is not immediately possible, comment out or temporarily remove pam_usb from the PAM configuration files for the affected services to prevent the crash from impacting users.

Generated by OpenCVE AI on June 18, 2026 at 21:20 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.164% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/mcdope/pam_usb/releases/tag/0.9.2
https://github.com/mcdope/pam_usb/security/advisories/GHSA-7j6h-wfc2-mg5q

History

Jun 18, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mcdope Mcdope pam Usb
Vendors & Products		Mcdope Mcdope pam Usb

Jun 18, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 18, 2026 5:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_loginctl_local() can cause a NULL dereference crash when parsing loginctl output. The function calls popen() and reads the result; if the Remote field is only a newline, fgets() succeeds but strtok_r(buf, "\n", &saveptr) returns NULL. A subsequent strcmp(is_remote, "no") then dereferences NULL, causing undefined behavior (typically SIGSEGV) and crashing the PAM module. This can crash the authenticating process (e.g., sudo, login) and, depending on PAM stack configuration, deny access for all users of the affected service. This issue has been fixed in version 0.9.2.
Title		pam_usb: NULL Dereference Crash in pusb_is_loginctl_local when loginctl Returns Empty Remote Field
Weaknesses		CWE-476
References		https://github.com/mcdope/pam_usb/releases/tag/0.9.2 https://github.com/mcdope/pam_usb/security/advisories/GHSA-7j6h-wfc2-mg5q
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`