mcdope pam_usb up to 0.9.0 on Linux src/evdev.c pusb_has_virtual_input_device error condition

Summaryinfo

A vulnerability marked as problematic has been reported in mcdope pam_usb up to 0.9.0 on Linux. Affected by this vulnerability is the function pusb_has_virtual_input_device of the file src/evdev.c. Performing a manipulation results in error condition. This vulnerability is identified as CVE-2026-48792. The attack is only possible with local access. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in mcdope pam_usb up to 0.9.0 on Linux. It has been classified as problematic. This affects the function pusb_has_virtual_input_device of the file src/evdev.c. The manipulation with an unknown input leads to a error condition vulnerability. CWE is classifying the issue as CWE-390. The product detects a specific error, but takes no actions to handle the error. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/evdev.c silently ignores EACCES errors when opening /dev/input/event* nodes, causing pusb_has_virtual_input_device() to return 0 (no virtual devices found) even when every open() call failed due to insufficient permissions. The caller in src/local.c cannot distinguish a clean absence of virtual devices from a permission-denied scan, and acts on the false negative by continuing authentication without denying. This vulnerability is fixed in 0.9.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-48792 since 05/22/2026. The exploitability is told to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.9.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• mcdope

Name

• pam_usb

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9.0

Website

• Product: https://github.com/mcdope/pam_usb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion