mcdope pam_usb up to 0.9.1 on Linux Removable Media usb_get_process_parent_id infinite loop

Summaryinfo

A vulnerability marked as problematic has been reported in mcdope pam_usb up to 0.9.1 on Linux. The affected element is the function usb_get_process_parent_id of the component Removable Media Handler. The manipulation leads to infinite loop. This vulnerability is uniquely identified as CVE-2026-48986. Local access is required to approach this attack. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in mcdope pam_usb up to 0.9.1 on Linux. It has been rated as problematic. This issue affects the function usb_get_process_parent_id of the component Removable Media Handler. The manipulation with an unknown input leads to a infinite loop vulnerability. Using CWE to declare the problem leads to CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. Impacted is availability. The summary by CVE is:

pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 and earlier, usb_get_process_parent_id() can cause an infinite loop DoS because it does not initialize *ppid on failure. In pusb_local_login(), the same variable is reused as input and output in a process-tree while loop; if /proc//stat cannot be read (for example, when an ancestor process exits during authentication), the PID is not updated and the loop does not terminate. This hangs the authenticating process (such as sudo, sshd, or login) until it is forcibly terminated. This issue has been fixed in version 0.9.2.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-48986 since 05/27/2026. The exploitation is known to be difficult. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 0.9.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-37923). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• mcdope

Name

• pam_usb

Version

• 0.9.0
• 0.9.1

Website

• Product: https://github.com/mcdope/pam_usb/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion