CVE-2026-44711: pam_usb Authentication Bypass Vulnerability

CVE-2026-44711 Overview

CVE-2026-44711 is a symlink attack vulnerability in pam_usb, a Pluggable Authentication Module (PAM) that provides hardware authentication for Linux using ordinary removable media. Versions prior to 0.8.7 mishandle the pad directory and pad files, allowing a local attacker to abuse symbolic links to bypass authentication and corrupt root-owned files. The flaw is tracked under CWE-59: Improper Link Resolution Before File Access. The maintainer released version 0.8.7 to address the issue.

Critical Impact
A local user can leverage symlink manipulation to bypass pam_usb authentication and overwrite arbitrary root-owned files, undermining system integrity and availability.

Affected Products

pam_usb versions prior to 0.8.7
Linux systems using pam_usb for hardware-based PAM authentication
Multi-user Linux environments where pam_usb pad directories are accessible to non-root users

Discovery Timeline

2026-05-27 - CVE-2026-44711 published to the National Vulnerability Database (NVD)
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44711

Vulnerability Analysis

pam_usb authenticates users by reading and writing one-time pad files stored on a removable USB device and within the user's home or system pad directory. The module performs file operations on these pad paths without safely resolving symbolic links. An attacker who controls a directory in the pad path can substitute symlinks pointing to root-owned files. When pam_usb runs with elevated privileges during PAM authentication, it follows these symlinks and writes pad data to the targeted file. This produces two outcomes: authentication state is manipulated to grant access, and arbitrary files owned by root are corrupted by pad data writes.

Root Cause

The vulnerability stems from improper link resolution before file access [CWE-59]. pam_usb opens and writes pad files without using O_NOFOLLOW, without validating that path components are not symlinks, and without ensuring directory ownership before traversal. Because PAM modules execute in the context of the calling service, file operations inherit elevated privileges and bypass the attacker's normal access restrictions.

Attack Vector

Exploitation requires local access and limited user interaction during an authentication event. The attacker plants symlinks within a pad directory they can write to, then triggers a pam_usb authentication flow. The module follows the malicious symlinks, writes pad content to root-owned targets, and may treat the resulting state as valid authentication. The CVSS vector indicates a local attack vector with low complexity, low privileges required, a scope change, and high integrity and availability impact.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-fjpm-p9pj-mp34 for additional technical context.

Detection Methods for CVE-2026-44711

Indicators of Compromise

Symbolic links present inside pam_usb pad directories such as /var/lib/pam_usb/ or user-level pad storage paths
Unexpected modifications to root-owned files with timestamps aligning to pam_usb authentication events
PAM authentication successes for accounts that should have failed pam_usb verification
pam_usb log entries showing pad writes to paths outside the expected pad directory

Detection Strategies

Audit pad directories for symlinks using find /var/lib/pam_usb -type l and equivalent checks in user pad locations
Enable Linux audit rules (auditd) on pad directories to log open, openat, and symlink syscalls during PAM operations
Correlate /var/log/auth.log PAM events with file integrity monitoring (FIM) alerts on root-owned files
Inventory installed pam_usb versions across Linux hosts and flag any version below 0.8.7

Monitoring Recommendations

Deploy file integrity monitoring on /etc, /var/lib/pam_usb, and other directories containing PAM configuration or pad data
Alert on creation of symlinks within directories writable by non-root users but read by privileged PAM modules
Centralize authentication and audit logs in a SIEM and build detections for anomalous PAM write activity

How to Mitigate CVE-2026-44711

Immediate Actions Required

Upgrade pam_usb to version 0.8.7 or later on all affected Linux systems
Inventory hosts using pam_usb and prioritize multi-user systems where local accounts are present
Remove any existing symlinks found inside pad directories and review affected files for integrity
Restrict write permissions on pad directories to root only, where the deployment allows

Patch Information

The maintainer released pam_usb version 0.8.7, which fixes the symlink handling logic in pad directory and pad file operations. See the GitHub Security Advisory GHSA-fjpm-p9pj-mp34 for patch details. Administrators should rebuild distribution packages or pull updated binaries that include the fixed version.

Workarounds

Disable pam_usb in /etc/pam.d/ configuration files until the patched version is deployed
Set strict ownership and 0700 permissions on pad directories so only root can create entries
Limit interactive local access to trusted users on systems where patching is delayed
Use mandatory access control (SELinux or AppArmor) to confine PAM module file access paths

bash

# Verify installed pam_usb version and disable the module pending patching
pam_usb --version
sudo sed -i 's/^\(auth.*pam_usb.so\)/# \1/' /etc/pam.d/common-auth
sudo find /var/lib/pam_usb -type l -print -delete
sudo chown -R root:root /var/lib/pam_usb && sudo chmod -R 700 /var/lib/pam_usb