An infinite loop DoS exists in pam_usb 0.9.1 and earlier because the function that retrieves the parent process ID does not initialize its output parameter on failure, and the same variable is then re‑used as a loop counter in a process‑tree walk. If the authentication process cannot read /proc/<pid>/stat—such as when an ancestor process exits during the authentication attempt—the loop never terminates, causing the authenticating process (e.g., sudo, sshd, or login) to hang until it is forcibly stopped.

The vulnerability affects the pam_usb plug‑in provided by the vendor mcdope for Linux systems. Versions 0.9.1 and earlier are impacted; the issue was fixed in release 0.9.2.

The CVSS score of 4.7 indicates moderate impact, and the EPSS score is not available. Since the vulnerability is only listed as a denial of service, no active exploitation is documented and the vulnerability is not in the CISA KEV catalog. An attacker would need to trigger authentication and cause a parent process to exit in order to force the infinite loop; this condition suggests that a privileged or local actor could potentially execute the attack, but the likelihood is considered moderate, and only a denial of service is possible.