mcdope pam_usb up to 0.9.1 on Linux Removable Media xfree compiler removal of code to clear buffers

Summaryinfo

A vulnerability was found in mcdope pam_usb up to 0.9.1 on Linux. It has been rated as problematic. This affects the function xfree of the component Removable Media Handler. This manipulation causes compiler removal of code to clear buffers. This vulnerability appears as CVE-2026-48984. The attack requires local access. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in mcdope pam_usb up to 0.9.1 on Linux and classified as problematic. Affected by this vulnerability is the function xfree of the component Removable Media Handler. The manipulation with an unknown input leads to a compiler removal of code to clear buffers vulnerability. The CWE definition for the vulnerability is CWE-14. Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka "dead store removal." As an impact it is known to affect confidentiality. The summary by CVE is:

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, the xfree() memory release helper in calls free() without first zeroing the buffer contents, releasing heap-allocated buffers containing sensitive data — including one-time pad bytes read from disk — without clearing, leaving the sensitive content in freed heap memory until it happens to be overwritten by a subsequent allocation. On a system where a use-after-free condition exists, or where a heap inspection primitive becomes available, this could allow recovery of pad values or other authentication material from freed memory regions. This is a defence-in-depth requirement consistent with prior hardening work in this codebase (GHSA-vx6f-rrqr-j87c applied explicit_bzero to some pad paths; this issue generalises the pattern to the central deallocation helper).

The advisory is shared at github.com. This vulnerability is known as CVE-2026-48984 since 05/27/2026. The exploitation appears to be difficult. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 0.9.2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• mcdope

Name

• pam_usb

Version

• 0.9.0
• 0.9.1

Website

• Product: https://github.com/mcdope/pam_usb/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion