CVE-2026-48792: pam_usb Authentication Bypass Vulnerability

CVE-2026-48792 Overview

CVE-2026-48792 is an authentication bypass vulnerability in pam_usb, a Pluggable Authentication Module (PAM) that provides hardware authentication for Linux systems using removable USB media. The flaw exists in versions prior to 0.9.1. The function pusb_has_virtual_input_device() in src/evdev.c silently ignores EACCES errors when opening /dev/input/event* device nodes. When every open() call fails due to insufficient permissions, the function returns 0, indicating no virtual input devices were found. The caller in src/local.c cannot distinguish a true negative from a permission-denied scan and proceeds with authentication.

Critical Impact
Local attackers with low privileges can bypass the virtual input device check in pam_usb, allowing authentication to continue under conditions where it should be denied.

Affected Products

pam_usb versions prior to 0.9.1
Linux systems using pam_usb for USB-based hardware authentication
PAM stacks that rely on pam_usb virtual input device detection for spoofing protection

Discovery Timeline

2026-05-27 - CVE-2026-48792 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-48792

Vulnerability Analysis

The pam_usb module authenticates users by verifying the presence of a registered USB device. To prevent spoofing through emulated USB devices, it scans /dev/input/event* nodes to identify virtual input devices that could be used to impersonate a legitimate hardware token. This anti-spoofing check is implemented in pusb_has_virtual_input_device() within src/evdev.c.

The function iterates over event device nodes and opens each one to inspect its properties. When open() returns EACCES due to insufficient file permissions, the error is silently ignored. The function then returns 0, signaling that no virtual devices were detected. This conflates two distinct outcomes: a clean scan with no virtual devices present, and a failed scan where access was denied for every node.

The caller in src/local.c treats the zero return value as a negative result and continues the authentication flow without denying access. This is classified under [CWE-390] (Detection of Error Condition Without Action).

Root Cause

The root cause is improper error handling in src/evdev.c. The code does not differentiate between a successful scan returning no results and a scan that failed because the process lacked permission to read /dev/input/event* nodes. The absence of explicit EACCES handling means the security-critical check fails open rather than fails closed.

Attack Vector

The attack requires local access with low privileges. An attacker operating under a user context that lacks read permissions on /dev/input/event* nodes can trigger the failure mode. Under these conditions, the anti-spoofing logic is effectively disabled, and a virtual or emulated input device could be presented as a legitimate USB hardware token during PAM authentication.

No verified public exploit code is available. The vulnerability mechanism is documented in the upstream GitHub Security Advisory and tracked in GitHub Issue #351 and GitHub Issue #55.

Detection Methods for CVE-2026-48792

Indicators of Compromise

Installed pam_usb package with version string below 0.9.1 reported by the package manager.
PAM authentication succeeding through pam_usb when the calling process lacks read access to /dev/input/event*.
Unexpected presence of uinput-created virtual input devices on systems using pam_usb for authentication.

Detection Strategies

Inventory all Linux endpoints and audit installed pam_usb versions against the fixed release 0.9.1.
Review /etc/pam.d/ configuration files for entries referencing pam_usb.so to identify hosts relying on this module.
Audit file permissions on /dev/input/event* nodes and compare against the user contexts that invoke pam_usb.

Monitoring Recommendations

Log PAM authentication events and alert on successful authentications through pam_usb from low-privilege accounts.
Monitor for creation of virtual input devices via uinput on systems where pam_usb is part of the authentication stack.
Track open() calls returning EACCES against /dev/input/event* paths from processes invoking pam_usb.

How to Mitigate CVE-2026-48792

Immediate Actions Required

Upgrade pam_usb to version 0.9.1 or later on all affected Linux systems.
Audit PAM configuration files in /etc/pam.d/ and confirm that pam_usb.so entries enforce the expected control flow.
Restrict local interactive access on systems where pam_usb is part of the authentication stack until patching is complete.

Patch Information

The vulnerability is fixed in pam_usb version 0.9.1. The patch updates src/evdev.c so that EACCES and other unexpected errors from open() on /dev/input/event* are no longer silently ignored. Refer to the GitHub Security Advisory GHSA-pvrg-chgw-x42c for the upstream fix details.

Workarounds

Remove pam_usb.so from PAM configuration files until the upgrade to 0.9.1 is applied.
Ensure that the process context invoking pam_usb has read permission on all /dev/input/event* nodes to prevent the silent-failure path.
Disable uinput kernel module loading on systems that do not require virtual input devices to reduce the spoofing surface.

bash

# Verify installed pam_usb version and upgrade where required
dpkg -l | grep pam-usb       # Debian/Ubuntu
rpm -q pam_usb               # RHEL/Fedora

# Example upgrade on Debian/Ubuntu after distribution update
sudo apt update && sudo apt install --only-upgrade libpam-usb

# Confirm fixed version
pam_usb --version | grep -E '0\.9\.1|0\.9\.[2-9]'