CVE-2026-44712: pam_usb Remote Code Execution Vulnerability

CVE-2026-44712 Overview

CVE-2026-44712 is a command injection vulnerability in pam_usb, a Pluggable Authentication Module (PAM) that provides hardware authentication for Linux systems using removable USB media. Versions prior to 0.8.7 fail to sanitize input passed to shell commands. A crafted USB filesystem UUID such as $(id>/tmp/rce) is written into the configuration file and later executed as root when an administrator runs pamusb-conf --reset-pads. The userName field parsed from the XML configuration is also passed to os.system() in pamusb-agent, invoking a shell. The flaw is tracked under CWE-78 (OS Command Injection) and is fixed in version 0.8.7.

Critical Impact
A USB device with an attacker-controlled filesystem UUID can inject shell commands that execute as root when the device is registered or pads are reset.

Affected Products

pam_usb versions prior to 0.8.7
pamusb-conf configuration utility
pamusb-agent daemon

Discovery Timeline

2026-05-27 - CVE-2026-44712 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44712

Vulnerability Analysis

The vulnerability stems from improper handling of attacker-influenced strings that are concatenated into shell command lines. pam_usb reads the filesystem UUID of a USB device and stores it in its XML configuration. Some USB mass storage controllers permit arbitrary UUID strings, allowing an attacker to embed shell metacharacters in this field.

When pamusb-conf --reset-pads is executed by a privileged user, the stored UUID is interpolated into a command passed to a shell. The shell interprets the embedded $( ) substitution and executes the attacker's payload with root privileges. A second injection point exists in pamusb-agent, where the userName value parsed from the XML configuration is passed directly to Python's os.system(), which spawns /bin/sh -c.

Root Cause

The root cause is the use of shell-interpolating APIs (os.system() and shell-evaluated subprocess calls) with untrusted input. The code treats UUIDs and usernames as safe identifiers and performs no escaping, quoting, or allowlist validation against shell metacharacters such as $, `, ;, and |.

Attack Vector

Exploitation requires local interaction. An attacker prepares a USB device whose filesystem UUID contains a shell command substitution, for example $(id>/tmp/rce). When an administrator runs pamusb-conf --add-device, the malicious UUID is stored in the configuration. The payload subsequently executes as root when pamusb-conf --reset-pads runs or when pamusb-agent processes the XML configuration. The attack requires high privileges to register the device but escalates to full root command execution because of the privilege context in which the affected utilities operate.

No public proof-of-concept exploit code is available. Refer to the GitHub Security Advisory GHSA-jgv5-w6rm-7wxg for the maintainer's technical description.

Detection Methods for CVE-2026-44712

Indicators of Compromise

Unexpected files created in world-writable directories such as /tmp/rce following USB device registration events.
Presence of shell metacharacters ($, `, ;, |, &) inside <device> UUID elements or <user> name elements in /etc/pamusb.conf.
Root-owned shell processes spawned as child processes of pamusb-conf or pamusb-agent.
USB devices with non-standard, overly long, or syntactically suspicious filesystem UUIDs.

Detection Strategies

Parse /etc/pamusb.conf and alert on UUID or username values that do not match a strict regular expression such as ^[A-Fa-f0-9-]+$ for UUIDs.
Monitor process execution telemetry for pamusb-conf or pamusb-agent spawning interpreters such as sh, bash, or python with unusual command lines.
Audit udev events correlated with subsequent shell activity occurring under the root user context.

Monitoring Recommendations

Enable Linux audit rules on /etc/pamusb.conf to capture all write operations and the responsible user.
Forward auditd and process telemetry to a centralized analytics platform to correlate USB insertion events with command execution.
Track invocations of pamusb-conf --add-device and pamusb-conf --reset-pads and review the device metadata recorded by each call.

How to Mitigate CVE-2026-44712

Immediate Actions Required

Upgrade pam_usb to version 0.8.7 or later on all Linux systems where the module is installed.
Inspect /etc/pamusb.conf for any UUID or username values containing shell metacharacters and remove suspicious entries.
Restrict who may run pamusb-conf and ensure only trusted administrators can register USB devices.

Patch Information

The issue is fixed in pam_usb 0.8.7. The patch sanitizes UUID and username values before they reach shell-invoking functions and replaces os.system() usage with safer subprocess calls. Details are published in the GitHub Security Advisory GHSA-jgv5-w6rm-7wxg.

Workarounds

If patching is not immediately possible, disable pam_usb by removing its entries from /etc/pam.d/ until the upgrade is applied.
Avoid running pamusb-conf --add-device or pamusb-conf --reset-pads against untrusted USB media.
Manually validate that every UUID in /etc/pamusb.conf matches the canonical UUID format before invoking any pamusb-conf subcommand.

bash

# Verify installed version and upgrade where applicable
pamusb-conf --version
# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade libpam-usb pamusb-tools
# Validate configuration UUIDs against canonical format
grep -oP 'serial="[^"]+"' /etc/pamusb.conf | \
  grep -vP 'serial="[A-Fa-f0-9-]+"'