Vulnerability Description
pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_loginctl_local() can cause a NULL dereference crash when parsing loginctl output. The function calls popen() and reads the result; if the Remote field is only a newline, fgets() succeeds but strtok_r(buf, "\n", &saveptr) returns NULL. A subsequent strcmp(is_remote, "no") then dereferences NULL, causing undefined behavior (typically SIGSEGV) and crashing the PAM module. This can crash the authenticating process (e.g., sudo, login) and, depending on PAM stack configuration, deny access for all users of the affected service. This issue has been fixed in version 0.9.2.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/mcdope/pam_usb/releases/tag/0.9.2
- https://github.com/mcdope/pam_usb/security/advisories/GHSA-7j6h-wfc2-mg5q
FAQ
What is CVE-2026-48985?
CVE-2026-48985 is a vulnerability with a CVSS score of 5.5 (MEDIUM). pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_loginctl_local() can cause a NULL dereference crash when parsing loginctl output...
How severe is CVE-2026-48985?
CVE-2026-48985 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-48985?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.