CVE-2026-44713: pam_usb RCE Vulnerability

CVE-2026-44713 Overview

CVE-2026-44713 is a command injection vulnerability in pam_usb, a Pluggable Authentication Module (PAM) that provides hardware authentication for Linux using removable media. The flaw exists in src/tmux.c, which reads the user-controlled $TMUX environment variable and passes it to popen() without sanitization. Because pam_usb executes inside the PAM stack with root privileges, a local authenticated user can inject arbitrary shell commands that execute as root. The vulnerability is classified as OS Command Injection [CWE-78] and is fixed in version 0.8.7.

Critical Impact
A local user can achieve root-level arbitrary command execution by crafting a malicious $TMUX environment variable that escapes the quoted argument passed to popen().

Affected Products

pam_usb versions prior to 0.8.7
Linux systems using pam_usb for hardware-based PAM authentication
Any service invoking the PAM stack where pam_usb is configured (login, sudo, su, display managers)

Discovery Timeline

2026-05-27 - CVE CVE-2026-44713 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44713

Vulnerability Analysis

The vulnerability resides in src/tmux.c within the pam_usb source tree. The module reads the $TMUX environment variable from the calling user's environment to determine the active tmux socket. It then splits the value on commas and embeds the socket-path component directly into a shell command string. That string is passed to popen(), which spawns /bin/sh -c to interpret it.

Because pam_usb runs inside the PAM stack, the popen() call executes with the privileges of the PAM-invoking process, typically root. An attacker who controls the $TMUX value at authentication time controls a shell command running as root.

Root Cause

The socket-path component is interpolated into the shell command inside double quotes without escaping or validation. Any double-quote character in the attacker-supplied value terminates the quoted literal and allows arbitrary shell metacharacters to follow. The module does not validate that the value resembles a legitimate tmux socket path, nor does it use execve()-style APIs that bypass shell interpretation. This is a textbook OS Command Injection [CWE-78] caused by combining untrusted input with popen().

Attack Vector

Exploitation requires local access and the ability to authenticate through a service that loads pam_usb. The attacker sets $TMUX to a value containing a closing double quote followed by shell syntax, for example a payload of the form socket",arbitrary;commands;#. When the PAM stack invokes pam_usb, the injected commands execute as root. The privilege boundary crossed is from a local unprivileged user to root, which aligns with the scope-changed, high-impact CVSS rating.

No verified public proof-of-concept code is referenced in the advisory. Technical details are described in the GitHub Security Advisory GHSA-822m-whrh-vrj8.

Detection Methods for CVE-2026-44713

Indicators of Compromise

Unexpected child processes of PAM-invoking binaries such as login, sshd, sudo, su, or display managers spawning /bin/sh with unusual arguments.
Authentication events where the user environment contains a $TMUX value with embedded ", ;, &, |, or backtick characters.
Root-owned processes launched immediately after a non-root user authentication that have no legitimate parent in the tmux workflow.

Detection Strategies

Audit auth.log and secure log entries correlated with process creation telemetry to flag popen()-style shell invocations originating from pam_usb.
Deploy auditd rules on execve calls whose parent process is a PAM consumer and whose command line contains shell metacharacters after a $TMUX reference.
Use behavioral endpoint detection to alert on root shells spawned by authentication binaries without an interactive terminal session.

Monitoring Recommendations

Inventory all Linux hosts with pam_usb installed and record the package version, comparing against 0.8.7.
Monitor /etc/pam.d/ configuration files for entries referencing pam_usb.so and confirm whether the module is active.
Forward authentication and process-execution telemetry to a central log platform for retrospective hunting against this injection pattern.

How to Mitigate CVE-2026-44713

Immediate Actions Required

Upgrade pam_usb to version 0.8.7 or later on all affected Linux systems.
If immediate patching is not possible, remove or comment out pam_usb.so entries in /etc/pam.d/ configuration files until the upgrade is applied.
Restrict local shell access on systems where pam_usb is loaded into the PAM stack.

Patch Information

The maintainers fixed the issue in pam_usb version 0.8.7. The patch addresses the unsafe interpolation of the $TMUX environment variable into the popen() command. Refer to the GitHub Security Advisory GHSA-822m-whrh-vrj8 for upstream remediation details.

Workarounds

Disable pam_usb by removing its line from PAM service configurations until the patched version is deployed.
Configure PAM-invoking services to scrub or unset the $TMUX environment variable before authentication, where supported.
Limit physical and remote local access to trusted users only, since exploitation requires authenticated local access.

bash

# Configuration example: temporarily disable pam_usb across services
sudo grep -rl 'pam_usb.so' /etc/pam.d/ | \
  xargs sudo sed -i 's/^\(.*pam_usb\.so.*\)$/# \1  # disabled: CVE-2026-44713/'

# Verify the installed pam_usb version after upgrade
dpkg -l | grep pam-usb   # Debian/Ubuntu
rpm -q pam_usb           # RHEL/Fedora