CVE-2026-48064 Overview
CVE-2026-48064 is an authorization bypass vulnerability in pam_usb, a Pluggable Authentication Module (PAM) that provides hardware authentication for Linux systems using removable media. The flaw exists in versions prior to 0.9.1. When a PAM service sets deny_remote=false, the PAM_RHOST check inside pusb_do_auth() is incorrectly skipped along with the local heuristics. As a result, remote XDMCP connections reach the USB device authentication path instead of being rejected. This issue is tracked under CWE-863: Incorrect Authorization and is fixed in version 0.9.1.
Critical Impact
Remote attackers can reach the USB authentication step on display managers configured with deny_remote=false, undermining the assumption that pam_usb authentication is restricted to local sessions.
Affected Products
- pam_usb versions prior to 0.9.1
- PAM services configured with deny_remote=false (commonly gdm-password, lightdm)
- Linux systems exposing XDMCP or remote display services that consume pam_usb
Discovery Timeline
- 2026-05-27 - CVE-2026-48064 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-48064
Vulnerability Analysis
The pam_usb module enforces several checks before granting authentication. One check inspects PAM_RHOST, a PAM item set by remote daemons such as sshd or XDMCP servers to record the remote client address. When PAM_RHOST is populated, authentication should be rejected because pam_usb is designed for local sessions only.
Administrators commonly disable deny_remote on display managers like gdm-password or lightdm to bypass process and TTY heuristics that incorrectly flag local sessions as remote. The vulnerable code gates the PAM_RHOST validation inside the same if (opts.deny_remote) branch. Disabling deny_remote silently removes the remote host rejection logic as well.
An attacker reaching the system through XDMCP can therefore advance to the USB device authentication stage from a remote network position. The vulnerability is classified as incorrect authorization under CWE-863.
Root Cause
The root cause is conflated control flow in pusb_do_auth(). Two independent checks — local process/TTY heuristics and the PAM_RHOST remote-host rejection — share a single conditional. Disabling local heuristics also disables remote rejection, producing an authorization decision based on incomplete state.
Attack Vector
Exploitation requires a Linux host running pam_usb below 0.9.1 with a service such as gdm-password or lightdm configured with deny_remote=false, and a reachable XDMCP listener. An attacker initiates an XDMCP session from a remote address. The PAM_RHOST value is populated but ignored. The session reaches pam_usb's device authentication step, removing the local-only enforcement boundary the module is meant to provide.
No public proof-of-concept code is referenced in the advisory. Technical details are available in GitHub Issue #348 and GitHub Security Advisory GHSA-w38v-cw9r-x9p6.
Detection Methods for CVE-2026-48064
Indicators of Compromise
- XDMCP session attempts originating from non-local IP addresses against hosts running display managers that load pam_usb.
- Authentication log entries from gdm-password or lightdm referencing pam_usb evaluations during sessions with a populated PAM_RHOST value.
- PAM configuration files containing deny_remote=false on services exposed to network-reachable display protocols.
Detection Strategies
- Inventory all hosts with pam_usb installed and compare the package version against 0.9.1 using package managers such as dpkg -l pam_usb or rpm -q pam_usb.
- Audit /etc/pam.d/ for any service stanza referencing pam_usb.so with the deny_remote=false option.
- Correlate XDMCP traffic on UDP port 177 with PAM authentication events to identify remote sessions reaching pam_usb.
Monitoring Recommendations
- Alert on inbound XDMCP connections from outside expected administrative subnets.
- Forward /var/log/auth.log and journalctl -u gdm/-u lightdm entries to a centralized log platform and flag pam_usb evaluations with non-empty remote host fields.
- Track changes to PAM configuration files using file integrity monitoring.
How to Mitigate CVE-2026-48064
Immediate Actions Required
- Upgrade pam_usb to version 0.9.1 or later on all affected Linux hosts.
- Remove deny_remote=false from any PAM service stanza unless explicitly required, and re-test local session behavior after the upgrade.
- Disable XDMCP on display managers that do not require remote display access.
Patch Information
The vulnerability is fixed in pam_usb version 0.9.1. The patch decouples the PAM_RHOST rejection logic from the deny_remote option, ensuring remote sessions are denied regardless of the local heuristic configuration. Patch details and the corrected control flow are documented in GitHub Security Advisory GHSA-w38v-cw9r-x9p6.
Workarounds
- Block inbound UDP port 177 (XDMCP) at the host firewall to prevent remote sessions from reaching display managers.
- Remove pam_usb.so from PAM stacks on services that accept remote authentication until the package is upgraded.
- Restrict display manager configuration to local console authentication only by disabling XDMCP listeners in gdm or lightdm configuration files.
# Configuration example: disable XDMCP in lightdm
# Edit /etc/lightdm/lightdm.conf and ensure the [XDMCPServer] section is removed or disabled
sudo sed -i '/^\[XDMCPServer\]/,/^\[/{/^enabled=/d}' /etc/lightdm/lightdm.conf
sudo systemctl restart lightdm
# Block XDMCP at the host firewall
sudo iptables -A INPUT -p udp --dport 177 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
