CVE-2026-44710: pam_usb Denial of Service Vulnerability

CVE-2026-44710 Overview

CVE-2026-44710 is a NULL pointer dereference vulnerability in pam_usb, a Pluggable Authentication Module (PAM) that provides hardware authentication for Linux systems using removable USB media. Versions prior to 0.8.7 pass return values from udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model() directly to strcmp() without checking for NULL. When a connected device does not expose these fields, the GIO/UDisks API returns NULL, causing strcmp() to trigger undefined behavior — typically a SIGSEGV crash. The flaw is tracked under CWE-476 and is fixed in version 0.8.7.

Critical Impact
An attacker with physical access can crash the authentication process by connecting a USB device that omits standard identification fields, disrupting PAM-mediated logins on affected systems.

Affected Products

pam_usb versions prior to 0.8.7
Linux systems using pam_usb for hardware-based PAM authentication
Systems integrating pam_usb with GIO/UDisks for removable media handling

Discovery Timeline

2026-05-27 - CVE-2026-44710 published to the National Vulnerability Database (NVD)
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44710

Vulnerability Analysis

The vulnerability resides in src/device.c within the pam_usb source tree. The code compares attributes of a connected USB device — serial number, vendor, and model — against a configured allow-list to authenticate a user. To retrieve these attributes, pam_usb calls three GIO/UDisks accessor functions: udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model().

According to the GIO/UDisks API documentation, each of these accessors may legitimately return NULL when a device does not expose the corresponding property. The vulnerable code passes the returned pointers directly into strcmp() without validating them. Per the C standard, dereferencing a NULL pointer through strcmp() is undefined behavior, and on Linux it produces a segmentation fault (SIGSEGV) that terminates the authentication module.

The attack vector is physical, and the impact is limited to availability: confidentiality and integrity are not affected. However, a crash inside an authentication module can deny legitimate users the ability to log in, depending on how PAM stack policies are configured.

Root Cause

The root cause is missing NULL validation on values returned from external API calls. The developers assumed the UDisks accessors would always return a valid string, contradicting the documented API contract. This is a classic CWE-476 NULL Pointer Dereference pattern.

Attack Vector

An attacker with physical access connects a USB device — or virtual USB gadget — that intentionally omits the serial, vendor, or model fields exposed via UDisks. When pam_usb enumerates the device during an authentication attempt, the accessor returns NULL and the subsequent strcmp() call crashes the PAM process. No prior authentication or user interaction is required.

The vulnerability is described in detail in the pam_usb GitHub Security Advisory GHSA-j8cq-2gv6-gfwf.

Detection Methods for CVE-2026-44710

Indicators of Compromise

Unexpected SIGSEGV or segmentation fault entries for processes loading pam_usb.so in /var/log/auth.log, journalctl, or dmesg.
Core dumps generated by PAM-aware services (login, sudo, sshd) coinciding with USB device insertion events from udev.
Repeated authentication failures or session terminations correlated with removable media hotplug events.

Detection Strategies

Audit installed pam_usb packages across Linux endpoints and compare versions against the fixed release 0.8.7.
Correlate udev device-add events with PAM crash telemetry to identify devices that lack serial, vendor, or model strings.
Monitor for processes invoking PAM stacks that terminate abnormally immediately after a USB insertion.

Monitoring Recommendations

Enable persistent core dump collection and forward crash signatures from authentication daemons to a centralized log platform.
Track changes to /etc/pam.d/ configurations referencing pam_usb.so and alert on additions to systems that do not require hardware authentication.
Inventory connected USB devices and flag devices that report empty or missing identification descriptors.

How to Mitigate CVE-2026-44710

Immediate Actions Required

Upgrade pam_usb to version 0.8.7 or later on all affected Linux systems.
Restrict physical access to systems where pam_usb is part of the authentication stack.
Review PAM configuration files to ensure a crash in pam_usb.so does not lock out administrators — keep an alternative authentication factor available.

Patch Information

The maintainers fixed the issue in pam_usb 0.8.7 by adding NULL checks before invoking strcmp() on the values returned from udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model(). Refer to the GitHub Security Advisory GHSA-j8cq-2gv6-gfwf for the upstream fix and release notes.

Workarounds

Temporarily remove or comment out pam_usb.so entries from /etc/pam.d/ configuration files until the package can be upgraded.
Configure pam_usb as an optional rather than required module so a crash does not deny access to legitimate users.
Disable USB hotplug for untrusted ports using udev rules or kernel module restrictions on systems exposed to physical access.

bash

# Configuration example: verify installed pam_usb version and upgrade
dpkg -l | grep pam-usb           # Debian/Ubuntu
rpm -q pam_usb                   # RHEL/Fedora

# Upgrade to the patched release (distribution-dependent)
sudo apt update && sudo apt install --only-upgrade libpam-usb

# Temporary mitigation: mark pam_usb as optional in the PAM stack
# /etc/pam.d/common-auth
# auth    optional    pam_usb.so