CVE-2026-48066: pam_usb Race Condition Vulnerability

CVE-2026-48066 Overview

CVE-2026-48066 is a race condition vulnerability in pam_usb, a Pluggable Authentication Module (PAM) that provides hardware authentication for Linux using removable USB media. Versions prior to 0.9.1 contain a process-wide static pointer in src/log.c that is overwritten on every PAM invocation with the address of a stack-local variable. This design violates PAM re-entrancy requirements and produces a data race when the PAM stack is invoked concurrently from multiple threads. The flaw is tracked under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization). The maintainers fixed the issue in version 0.9.1.

Critical Impact
Concurrent PAM invocations against pam_usb can dereference a stale stack pointer, causing integrity issues in log output and process crashes that may deny authentication services.

Affected Products

pam_usb versions prior to 0.9.1
Linux systems integrating pam_usb into multi-threaded PAM consumers
Authentication workflows that invoke the PAM stack concurrently

Discovery Timeline

2026-05-27 - CVE-2026-48066 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-48066

Vulnerability Analysis

The vulnerability resides in src/log.c within the pam_usb codebase. The file declares a process-wide static pointer that the module updates on every PAM invocation. The pointer is set to reference a stack-local variable belonging to the calling PAM function. When the PAM stack returns, the referenced stack frame is reclaimed, but the static pointer continues to retain the now-invalid address.

PAM modules must be re-entrant because applications such as login daemons, SSH servers, and identity brokers may invoke the PAM stack from multiple threads simultaneously. By caching thread-unsafe state in a global pointer, pam_usb breaks this contract. Concurrent threads racing on the static pointer can observe a stack address belonging to a different thread or a frame that has already unwound. See the GitHub Security Advisory GHSA-qg76-57wq-mpv6 for upstream details.

Root Cause

The root cause is improper synchronization of a shared resource. A static (global) pointer holds a reference to thread-local stack data without any locking, thread-local storage, or lifetime management. This creates both a use-after-return condition and a data race when multiple threads write to and read from the pointer simultaneously.

Attack Vector

Exploitation requires local access to a system where a multi-threaded application invokes the PAM stack containing pam_usb under concurrent load. An attacker triggering parallel authentication attempts can cause the racing threads to dereference invalid stack memory, leading to corrupted log records, undefined behavior, or process termination that degrades availability of authentication services. The CVSS vector indicates no impact on confidentiality but measurable impact on integrity and availability. No public proof-of-concept code is available. Refer to GitHub Issue #350 and GitHub Issue #55 for reproduction context.

Detection Methods for CVE-2026-48066

Indicators of Compromise

Crashes or segmentation faults in processes that load pam_usb, including sshd, login, su, or sudo worker threads
Corrupted, truncated, or interleaved entries in pam_usb log output during concurrent authentication events
Unexpected denial of authentication requests under high concurrency on hosts using pam_usb

Detection Strategies

Inventory Linux hosts that have pam_usb installed and identify the package version with dpkg -l pam-usb or rpm -q pam_usb
Audit /etc/pam.d/ configuration files for references to pam_usb.so to determine which authentication services load the module
Review crash logs in journalctl and /var/log/messages for repeated faults originating in pam_usb library frames

Monitoring Recommendations

Alert on abnormal termination of PAM-consuming daemons such as sshd, gdm, or login on systems with pam_usb deployed
Monitor authentication failure rates and PAM error returns for spikes that correlate with concurrent session activity
Forward host crash dumps and PAM logs to a centralized log platform for cross-host correlation

How to Mitigate CVE-2026-48066

Immediate Actions Required

Upgrade pam_usb to version 0.9.1 or later on all affected Linux hosts
Identify every PAM service file referencing pam_usb.so and validate that the patched module is loaded after upgrade
Restart services that have pam_usb loaded so the patched library is mapped into running processes

Patch Information

The maintainers released a fix in pam_usb version 0.9.1, which eliminates the static pointer pattern in src/log.c and restores PAM re-entrancy compliance. Patch details are published in the GitHub Security Advisory GHSA-qg76-57wq-mpv6.

Workarounds

Remove pam_usb.so from PAM configuration files in /etc/pam.d/ on hosts that cannot be upgraded immediately
Restrict use of pam_usb to single-threaded PAM consumers until patching is completed
Limit local access to affected systems to reduce opportunities to trigger concurrent PAM invocations

bash

# Verify installed pam_usb version and confirm patched build
pam_usb_check --version
dpkg -l | grep pam-usb