CVE-2026-47269: pam_usb Auth Bypass Vulnerability

CVE-2026-47269 Overview

CVE-2026-47269 is an authentication bypass vulnerability in pam_usb, a Pluggable Authentication Module (PAM) that provides hardware authentication for Linux using removable USB media. The flaw resides in the deny_remote feature, which is supposed to block authentication attempts originating from remote sessions. Due to an incomplete check of the utmpx ut_addr_v6 address field, IPv4-mapped IPv6 addresses are misclassified as local connections. An attacker possessing a registered USB device can authenticate over SSH against an affected host as if seated at the local console. The issue affects all pam_usb versions prior to 0.9.0 and is categorized under [CWE-284] Improper Access Control.

Critical Impact
Attackers with a registered USB token can bypass deny_remote=true and authenticate over SSH on Ubuntu and Debian systems where sshd listens on the IPv6 wildcard ::.

Affected Products

pam_usb versions prior to 0.9.0
Linux systems running sshd with AddressFamily any bound to ::
Ubuntu and Debian distributions using default SSH configurations

Discovery Timeline

2026-05-27 - CVE-2026-47269 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-47269

Vulnerability Analysis

The pam_usb module enforces a deny_remote policy to ensure USB-based authentication only succeeds for users physically present at the system. To distinguish local from remote sessions, the module inspects the ut_addr_v6 field of the utmpx entry associated with the login. The implementation guards the remote-detection logic with if (utent->ut_addr_v6[0] != 0), examining only the first 32-bit word of the 128-bit IPv6 address. This single-word check fails to account for IPv4-mapped IPv6 addresses of the form ::ffff:x.x.x.x, which store the IPv4 octets in ut_addr_v6[3] while ut_addr_v6[0] remains zero. When the check evaluates to false, the remote-detection block is skipped entirely and the session is treated as local, defeating the deny_remote restriction.

Root Cause

The root cause is improper validation of a multi-word network address structure. The original guard treats the 128-bit IPv6 address as if its first word alone indicates presence of an address, ignoring the encoding rules for IPv4-mapped IPv6 addresses defined in RFC 4291. The fix in version 0.9.0 extends the check to evaluate all four 32-bit words of ut_addr_v6 and explicitly handles IPv4-mapped representations.

Attack Vector

Exploitation requires the attacker to possess a USB device already registered for pam_usb authentication on the target host. On Ubuntu and Debian systems where sshd listens on the IPv6 wildcard :: with AddressFamily any, incoming IPv4 connections are logged in utmpx as IPv4-mapped IPv6 addresses. The attacker connects to the target over SSH from a remote network, presents the registered USB device, and pam_usb accepts the authentication despite deny_remote=true. No additional privileges or user interaction are required beyond control of the USB token. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-47269

Indicators of Compromise

SSH authentication events in /var/log/auth.log where pam_usb reports a successful authentication while the connection originates from a non-loopback IPv4 source.
utmpx entries showing IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) correlated with successful pam_usb sessions.
Concurrent pam_usb authentication and active SSH sessions for the same user from a non-local source IP.

Detection Strategies

Audit installed pam_usb package versions across Linux fleets and flag any host running a version earlier than 0.9.0.
Parse PAM logs for pam_usb success events and join against sshd accepted-publickey or password records to identify remote sessions that should have been blocked.
Inspect sshd_config for AddressFamily any or ListenAddress :: combined with pam_usb enabled in /etc/pam.d/.

Monitoring Recommendations

Forward auth.log, secure, and wtmp/utmp records to a centralized log platform for correlation between PAM module outcomes and connection metadata.
Alert when a USB-authenticated login occurs from a source address outside the loopback range or the host's local subnets.
Track configuration drift on PAM stack files and SSH daemon configuration to detect environments where this bypass becomes exploitable.

How to Mitigate CVE-2026-47269

Immediate Actions Required

Upgrade pam_usb to version 0.9.0 or later on all affected Linux systems.
Until patching is complete, disable pam_usb in /etc/pam.d/ for services reachable over the network, particularly sshd.
Inventory hosts where sshd listens on :: with AddressFamily any and prioritize them for remediation.

Patch Information

The upstream fix is available in pam_usb0.9.0. The remediation rewrites the ut_addr_v6 evaluation so that all four words of the address field are inspected and IPv4-mapped IPv6 addresses are correctly classified as remote. Review the GitHub commit for the exact code change.

Workarounds

Restrict sshd to IPv4 only by setting AddressFamily inet in /etc/ssh/sshd_config, which prevents IPv4-mapped IPv6 entries in utmpx.
Remove pam_usb from the PAM stack used by sshd so USB authentication is only consulted for local console logins.
Enforce network-level controls (firewall rules, bastion hosts) that prevent direct SSH access to systems relying on pam_usb for access decisions.

bash

# Configuration example: limit sshd to IPv4 to neutralize the bypass
# /etc/ssh/sshd_config
AddressFamily inet
ListenAddress 0.0.0.0

# Reload sshd after changes
sudo systemctl reload ssh