SecuriTricks - CVE-2026-48986

Description

pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 and earlier, usb_get_process_parent_id() can cause an infinite loop DoS because it does not initialize *ppid on failure. In pusb_local_login(), the same variable is reused as input and output in a process-tree while loop; if /proc/<pid>/stat cannot be read (for example, when an ancestor process exits during authentication), the PID is not updated and the loop does not terminate. This hangs the authenticating process (such as sudo, sshd, or login) until it is forcibly terminated. This issue has been fixed in version 0.9.2.

Product(s) Impacted

Vendor	Product	Versions
Pam Usb	Pam Usb	0.9.1, 0.9.2

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	pam_usb	pam_usb	0.9.1	/	/	/	/	/	/	/
a	pam_usb	pam_usb	0.9.2	/	/	/	/	/	/	/

References

https://github.com/mcdope/pam_usb/releases/tag/0.9.2

https://github.com/mcdope/pam_usb/security/advisories/GHSA-h28h-9hc3-v595

CVSS Score

4.7 / 10

CVSS Data - 3.1

Attack Vector: LOCAL
Attack Complexity: HIGH
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

View Vector String

Timeline

Published: June 18, 2026, 6:16 p.m.
Last Modified: June 18, 2026, 6:16 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2026-48986