CVE-2026-48065: pam_usb Buffer Overflow Vulnerability

CVE-2026-48065 Overview

CVE-2026-48065 is a heap overflow vulnerability in pam_usb, a Pluggable Authentication Module (PAM) that provides hardware authentication for Linux using ordinary USB removable media. The flaw resides in src/conf.c, where the module allocates heap memory proportional to a device count parsed from the configuration file without enforcing an upper bound. On 32-bit targets such as armv7l and i686, the size calculation wraps around size_t, leading to an undersized allocation followed by out-of-bounds writes. The issue is tracked under [CWE-122] (Heap-based Buffer Overflow) and is fixed in version 0.9.1.

Critical Impact
A local attacker with high privileges who can influence the pam_usb configuration file can corrupt heap memory on 32-bit systems, leading to compromise of confidentiality, integrity, and availability.

Affected Products

pam_usb versions prior to 0.9.1
32-bit Linux builds on armv7l architecture
32-bit Linux builds on i686 architecture

Discovery Timeline

2026-05-27 - CVE CVE-2026-48065 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-48065

Vulnerability Analysis

The vulnerability stems from unchecked arithmetic during heap allocation in src/conf.c. The pam_usb module parses its XML configuration file using libxml2 XPath evaluation. The result of that evaluation produces n_devices, a count of configured devices. The code then allocates a buffer sized as n_devices * sizeof(t_pusb_device) and passes the result to xmalloc().

On 32-bit architectures, size_t is 32 bits wide. A sufficiently large n_devices value causes the multiplication to overflow and wrap to a small number. xmalloc() returns a small but valid non-NULL pointer, and only invokes abort() when the allocator itself returns NULL. The subsequent loop writes per-device structures into the undersized buffer, overflowing adjacent heap chunks.

Root Cause

The root cause is an Integer Overflow (CWE-190) feeding a Heap-based Buffer Overflow (CWE-122). The allocation path does not validate n_devices against a maximum, nor does it use overflow-safe allocation helpers such as calloc() with its built-in multiplication check. The xmalloc() wrapper only guards against allocator failure, not against caller-supplied size truncation.

Attack Vector

Exploitation requires local access with high privileges, because an attacker must place or modify the pam_usb XML configuration consumed at authentication time. An attacker who controls the configuration can declare a large device count that triggers the wraparound. When pam_usb is invoked during authentication, the corrupted heap layout can be leveraged to manipulate adjacent allocations within the PAM-loading process.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-24mw-m2vf-36vp for upstream technical details.

Detection Methods for CVE-2026-48065

Indicators of Compromise

Unexpected modifications to the pam_usb configuration file, particularly entries declaring abnormally large numbers of device elements.
Crashes or abort() events in processes that load the pam_usb.so PAM module on 32-bit hosts.
Anomalous child processes or privilege transitions originating from PAM-enabled services such as login, sudo, or sshd.

Detection Strategies

Inventory Linux endpoints running 32-bit armv7l or i686 builds with pam_usb installed at versions below 0.9.1.
Monitor file integrity on the pam_usb XML configuration to detect unauthorized edits.
Review PAM stack configuration in /etc/pam.d/ for inclusion of pam_usb.so on affected systems.

Monitoring Recommendations

Enable auditd rules to log write access to the pam_usb configuration path.
Forward PAM-related authentication logs to a central log store for correlation with crash and segfault events.
Alert on repeated authentication failures or service restarts that coincide with configuration file changes.

How to Mitigate CVE-2026-48065

Immediate Actions Required

Upgrade pam_usb to version 0.9.1 or later on all affected hosts.
Restrict write permissions on the pam_usb XML configuration to the root user only.
Audit existing configurations for unexpected or excessive device entries before applying the patch.

Patch Information

The upstream fix is included in pam_usb0.9.1. The patch enforces an upper bound on n_devices prior to allocation, preventing the multiplication from wrapping size_t. Refer to the GitHub Security Advisory GHSA-24mw-m2vf-36vp, GitHub Issue #352, and GitHub Issue #55 for the upstream discussion.

Workarounds

Remove pam_usb.so from the PAM stack in /etc/pam.d/ until the package can be upgraded.
On 32-bit systems where upgrade is not immediately possible, migrate to a 64-bit build where the wraparound is not reachable with practical device counts.
Set strict file ownership (root:root) and mode 0600 on the pam_usb configuration to prevent tampering by lower-privileged accounts.

bash

# Configuration example: restrict pam_usb config and verify version
sudo chown root:root /etc/security/pam_usb.conf
sudo chmod 0600 /etc/security/pam_usb.conf
dpkg -l | grep pam-usb   # Debian/Ubuntu
rpm -q pam_usb           # RHEL/Fedora