mcdope pam_usb up to 0.9.1 on Linux lstat toctou

Summaryinfo

A vulnerability classified as critical has been found in mcdope pam_usb up to 0.9.1 on Linux. Affected by this vulnerability is the function lstat. Performing a manipulation results in toctou. This vulnerability was named CVE-2026-48983. The attack needs to be approached locally. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in mcdope pam_usb up to 0.9.1 on Linux. It has been classified as critical. This affects the function lstat. The manipulation with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, a symlink race condition exists in per-device and per-user pad directory creation. pam_usb uses a check-then-act pattern: it calls lstat() to test for existence and then calls mkdir() separately to create the directory. A local attacker can win the race between these calls by replacing the target path with a symlink to a directory they control. If successful, one-time pad files may be written to an attacker-controlled location, potentially exposing future pad values before use or disrupting authentication. This issue has been fixed in version 0.9.2.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-48983 since 05/27/2026. The exploitability is told to be difficult. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 0.9.2 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• mcdope

Name

• pam_usb

Version

• 0.9.0
• 0.9.1

Website

• Product: https://github.com/mcdope/pam_usb/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion