CVE-2026-48986

pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 and earlier, usb_get_process_parent_id() can cause an infinite loop DoS because it does not initialize *ppid on failure. In pusb_local_login(), the same variable is reused as input and output in a process-tree while loop; if /proc/<pid>/stat cannot be read (for example, when an ancestor process exits during authentication), the PID is not updated and the loop does not terminate. This hangs the authenticating process (such as sudo, sshd, or login) until it is forcibly terminated. This issue has been fixed in version 0.9.2.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/mcdope/pam_usb/releases/tag/0.9.2
https://github.com/mcdope/pam_usb/security/advisories/GHSA-h28h-9hc3-v595

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) pam_usb proporciona autenticación de hardware para Linux utilizando medios extraíbles. En pam_usb 0.9.1 y anteriores, usb_get_process_parent_id() puede causar un DoS de bucle infinito porque no inicializa ppid al fallar. En pusb_local_login(), la misma variable se reutiliza como entrada y salida en un bucle while de árbol de procesos; si /proc/[pid]/stat no se puede leer (por ejemplo, cuando un proceso ancestro sale durante la autenticación), el PID no se actualiza y el bucle no termina. Esto cuelga el proceso de autenticación (como sudo, sshd o login) hasta que se termina forzosamente. Este problema ha sido solucionado en la versión 0.9.2.

Information

Published : 2026-06-18 18:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-48986

Mitre link : CVE-2026-48986

CVE.ORG link : CVE-2026-48986

JSON object : View

Products Affected

No product.

CWE

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

{"id": "CVE-2026-48986", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48986", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T12:34:27.319918Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "mcdope", "product": "pam_usb", "versions": [{"status": "affected", "version": "< 0.9.2"}]}]}], "published": "2026-06-18T18:16:19.807", "references": [{"url": "https://github.com/mcdope/pam_usb/releases/tag/0.9.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-h28h-9hc3-v595", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 and earlier, usb_get_process_parent_id() can cause an infinite loop DoS because it does not initialize *ppid on failure. In pusb_local_login(), the same variable is reused as input and output in a process-tree while loop; if /proc/<pid>/stat cannot be read (for example, when an ancestor process exits during authentication), the PID is not updated and the loop does not terminate. This hangs the authenticating process (such as sudo, sshd, or login) until it is forcibly terminated. This issue has been fixed in version 0.9.2."}, {"lang": "es", "value": "pam_usb proporciona autenticaci\u00f3n de hardware para Linux utilizando medios extra\u00edbles. En pam_usb 0.9.1 y anteriores, usb_get_process_parent_id() puede causar un DoS de bucle infinito porque no inicializa ppid al fallar. En pusb_local_login(), la misma variable se reutiliza como entrada y salida en un bucle while de \u00e1rbol de procesos; si /proc/[pid]/stat no se puede leer (por ejemplo, cuando un proceso ancestro sale durante la autenticaci\u00f3n), el PID no se actualiza y el bucle no termina. Esto cuelga el proceso de autenticaci\u00f3n (como sudo, sshd o login) hasta que se termina forzosamente. Este problema ha sido solucionado en la versi\u00f3n 0.9.2."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}