CVE-2026-48985: pam_usb NULL Pointer Dereference Authentication Crash

Technical summary

The vulnerability resides in the pusb_is_loginctl_local() function, which calls popen() to execute loginctl and parses its output to determine whether a login session is local or remote. The function reads lines with fgets() and attempts to extract the Remote field value using strtok_r(buf, "\n", &saveptr). If the Remote field contains only whitespace followed by a newline—a valid but edge-case input—strtok_r() returns NULL. The subsequent strcmp(is_remote, "no") call then dereferences this NULL pointer, causing undefined behavior. On most systems, this results in a segmentation fault (SIGSEGV) that terminates the PAM module. The severity of the impact depends on how the PAM stack is configured around pam_usb; if the module's failure is configured to deny access, the crash will lock out all users of that service.

Business impact

Organizations using pam_usb for authentication face a denial-of-service risk on affected systems. If pam_usb is integrated into a critical authentication flow—such as sudo access or SSH login—a crash can render those services inaccessible. The impact is amplified in configurations where PAM is set to deny access on module failure. This vulnerability does not leak data or grant unauthorized access, but it can disrupt legitimate user workflows and administrative access. Remediation is straightforward: upgrade to version 0.9.2 or later.

Affected systems

pam_usb versions 0.9.1 and earlier are vulnerable. The vulnerability only affects Linux systems that have pam_usb installed and configured in their PAM authentication stack. Systems using pam_usb for removable-media-based authentication (such as USB key authentication) are at risk. The vendor's product listing is not available in the source data; verify whether your deployments include pam_usb and check the installed version against your vendor's release history.

Exploitability

This vulnerability requires local access (AV:L) and existing user privileges (PR:L) to trigger. An attacker cannot exploit it remotely or gain elevated privileges through this flaw. However, the crash is deterministic when the precondition is met: the loginctl output must contain a Remote field with only a newline. A local user with sufficient privileges to trigger a login session query could intentionally craft or observe conditions that cause the crash. In practice, the vulnerability is most likely to be triggered by normal system behavior rather than active exploitation, making it a denial-of-service risk rather than a high-impact attack surface.

Remediation

Upgrade pam_usb to version 0.9.2 or later. The fix adds proper NULL validation after strtok_r() to ensure that the parsed field is not NULL before attempting string comparison. Organizations should prioritize patching based on whether pam_usb is essential to their authentication infrastructure and whether PAM is configured to deny access on module failure.

Patch guidance

Install pam_usb version 0.9.2 or later. Consult your Linux distribution's package management system or the pam_usb project's release notes for installation instructions. If pam_usb is compiled from source, verify the commit history to confirm the NULL pointer check is present. Before deploying updates to production, test that your PAM configuration remains functional and that authentication continues to work as expected for both local and removable-media-based logins.

Detection guidance

Monitor system logs for SIGSEGV crashes in the PAM module or unexpected authentication service failures. If pam_usb is in use, check the version via the package manager (e.g., 'dpkg -l | grep pam-usb' on Debian/Ubuntu) or by querying the pam_usb binary directly if available. Crashes will typically appear in syslog or the authentication daemon's log with segmentation fault or core dump messages. Enable core dumps temporarily if needed to confirm the crash originates from pam_usb. Implement version inventory controls to track deployed pam_usb versions and flag any below 0.9.2.

Why prioritize this

This vulnerability merits medium-priority attention for organizations using pam_usb. Although the CVSS score is 5.5 (MEDIUM severity), the impact on critical authentication services and the ease of triggering the crash via normal system behavior make it a practical concern. Patching is low-risk and straightforward, reducing the barrier to remediation. Organizations that do not use pam_usb can deprioritize this issue entirely. Those that do should treat it as a near-term target for maintenance windows.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects the local attack vector (AV:L) and required user privileges (PR:L), which limit the immediate threat surface. However, the high availability impact (A:H) is warranted because the crash can deny service to all users of the affected authentication mechanism. The score does not account for the ease of triggering the condition—the NULL dereference occurs predictably when loginctl output matches a specific format—or the criticality of authentication to system operations. This makes the practical risk higher than the CVSS score alone suggests for organizations where pam_usb is central to their access control.

Frequently asked questions