CVE-2026-47270: pam_usb Race Condition Vulnerability

CVE-2026-47270 Overview

CVE-2026-47270 is a race condition vulnerability in pam_usb, a Pluggable Authentication Module (PAM) that provides hardware authentication for Linux using removable media. Versions prior to 0.9.0 use the non-reentrant strtok() function inside three routines that support the deny_remote feature. When display managers such as GDM run concurrent authentication threads, one thread can overwrite another's tokenization state. The flaw also corrupts the live process environment because pusb_tmux_get_client_tty() passes a pointer returned by getenv("TMUX") directly to strtok(), which writes NUL bytes into the environment block.

Critical Impact
The race condition can cause deny_remote=true to incorrectly permit a remote session or incorrectly deny a local session, undermining the integrity of USB-based hardware authentication on multi-threaded display managers.

Affected Products

pam_usb versions prior to 0.9.0
Linux systems using pam_usb for hardware authentication via PAM
Display managers loading pam_usb (GDM, GNOME Shell, sudo, login)

Discovery Timeline

2026-05-27 - CVE-2026-47270 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-47270

Vulnerability Analysis

The vulnerability is a classic race condition [CWE-362] arising from the use of non-reentrant C library functions in a multi-threaded context. pam_usb loads into long-lived host processes such as GDM, which dispatch multiple concurrent PAM authentication threads. Three functions backing the deny_remote feature call strtok(), which maintains parsing state in a single global pointer shared across all threads in the process.

When two authentication operations interleave, one thread's call to strtok() overwrites the in-progress tokenization pointer of another thread. This corrupts parsing of tmux session data and the /proc/<pid>/environ scan that backs remote-session detection. The decision produced by deny_remote can therefore flip in either direction depending on thread interleaving.

Root Cause

The root cause is twofold. First, strtok() is not thread-safe and should not be used in PAM modules that may be loaded concurrently. Second, pusb_tmux_get_client_tty() passes the raw pointer returned by getenv("TMUX") directly to strtok(). Because getenv() returns a pointer into the live process environment block, strtok() permanently inserts NUL bytes into the TMUX environment variable. In long-lived display manager processes, the corruption persists across all subsequent authentications.

Attack Vector

Exploitation requires local access and low privileges, but high attack complexity due to the timing dependency. An attacker triggers concurrent authentications against a display manager loading pam_usb and races the tokenization state to influence the remote-session decision. The result can bypass deny_remote enforcement and authenticate a remote session that policy intended to block.

// Fix from src/local.c replacing non-reentrant inet_ntoa with reentrant inet_ntop
if (utent->ut_addr_v6[0] != 0) {
    struct in_addr ipnetw;
    ipnetw.s_addr = utent->ut_addr_v6[0];
    char ipbuf[INET_ADDRSTRLEN];
    const char *ipaddr = inet_ntop(AF_INET, &ipnetw, ipbuf, sizeof(ipbuf));
    if (ipaddr == NULL) ipaddr = "(unknown)";

    log_error("Remote authentication request, host: %s, ip: %s\n", utent->ut_host, ipaddr);
    return (-1);
}
// Source: https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd

Detection Methods for CVE-2026-47270

Indicators of Compromise

Successful authentications through pam_usb from remote sessions where deny_remote=true is configured.
Unexpected PAM authentication failures on local sessions correlated with concurrent login activity on the display manager.
Corrupted or truncated TMUX environment variable in long-lived GDM or GNOME Shell processes.

Detection Strategies

Inventory hosts running pam_usb and verify the installed version against 0.9.0 using package manager queries.
Audit PAM configuration files under /etc/pam.d/ for pam_usb.so entries combined with deny_remote options.
Review authentication logs in /var/log/auth.log or via journalctl for pam_usb decisions that conflict with session origin.

Monitoring Recommendations

Forward PAM and display manager logs to a centralized log platform and alert on pam_usb authentication anomalies.
Monitor for repeated concurrent authentication attempts against GDM that could indicate race-condition exploitation.
Track package versions of pam_usb across the Linux fleet to confirm patch deployment.

How to Mitigate CVE-2026-47270

Immediate Actions Required

Upgrade pam_usb to version 0.9.0 or later on all affected Linux endpoints and servers.
Audit /etc/pam.d/ configurations and confirm deny_remote policy enforcement after upgrading.
Restart display manager services (for example systemctl restart gdm) so the patched module is loaded and any environment corruption from prior runs is cleared.

Patch Information

The vulnerability is fixed in pam_usb 0.9.0. Reference commits include pam_usb commit 94f1640 and pam_usb commit d003e55. Full details are provided in the GHSA-j3xw-vc43-x7jg advisory.

Workarounds

If upgrading is not immediately possible, remove pam_usb.so from PAM configuration files for services exposed to concurrent authentication (notably GDM and GNOME Shell).
Disable the deny_remote feature until the patched version is installed, and enforce remote session restrictions with sshd_config or AllowUsers policies instead.
Restrict local user access to trusted accounts only to reduce the population that can trigger concurrent authentication races.

bash

# Verify pam_usb version and locate PAM configuration
dpkg -l | grep pam-usb        # Debian/Ubuntu
rpm -q pam_usb                # RHEL/Fedora
grep -R "pam_usb" /etc/pam.d/

# Restart display manager after upgrading to 0.9.0
sudo systemctl restart gdm