By weakness (CWE)

CWE-226: related vulnerabilities

CVEs classified under CWE-226. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

• CVE-2026-48984MEDIUM 4.7

  pam_usb is a Linux authentication tool that uses removable media (like USB drives) as a hardware security key. A flaw in versions 0.9.1 and earlier leaves sensitive authentication data—specifically one-time pad values—sitting in freed memory instead of securely erasing it. If an attacker gains local access and can inspect heap memory (either through a use-after-free bug or memory inspection tools), they could potentially recover these pad values and bypass authentication. The issue affects the central memory deallocation function, which should be clearing sensitive buffers before releasing them.