mcdope pam_usb up to 0.9.1 on Linux open race condition

Summaryinfo

A vulnerability was found in mcdope pam_usb up to 0.9.1 on Linux. It has been rated as problematic. Impacted is the function Open. Performing a manipulation results in race condition. This vulnerability is reported as CVE-2026-48982. The attack requires a local approach. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in mcdope pam_usb up to 0.9.1 on Linux. This affects the function open. The manipulation with an unknown input leads to a race condition vulnerability. CWE is classifying the issue as CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, when updating a one-time pad file, a temporary file is created using open() without the O_EXCL flag. Without O_EXCL, the create operation is not atomic: two concurrent processes racing to update the same pad may both succeed in opening the file, with the second write silently overwriting the first. The one-time pad is the core replay-prevention mechanism of pam_usb. A successful race could result in the stored pad value diverging from what either process expected, potentially causing authentication failures or, in a precisely timed attack, creating a window for pad reuse. This issue has been fixed in version 0.9.2.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-48982 since 05/27/2026. The exploitability is told to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.9.2 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• mcdope

Name

• pam_usb

Version

• 0.9.0
• 0.9.1

Website

• Product: https://github.com/mcdope/pam_usb/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion