{"id":"CVE-2026-64667","kind":"vulnerability","aliases":["CVE-2026-64667"],"related":[],"title":"pam_usb: buffer over-read in Linux login authentication can crash PAM","description":"pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c (pusb_get_tty_from_display_server) allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separator with a space. When read(2) returns exactly 4096 bytes for any process the function inspects, the buffer ends without a terminator and the subsequent strstr() calls scan past the allocation boundary. The function is invoked during normal PAM authentication when DISPLAY is set, so the read fires for every process at auth time. Consequences are bounded: strstr output is a Boolean substring match (limited info-disclosure surface) but a hostile heap layout can produce a SIGSEGV that terminates the host PAM process. This issue has been patched in version 0.9.3.","summary":"pam_usb is a PAM module that lets removable media unlock Linux logins. A missing string terminator in its command-line reader lets strstr scan past a heap buffer, which can crash the PAM process.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","package","pam","pam_usb"],"not_affected_if":["pam-usb-not-configured"],"how_to_check":"- Check the installed pam_usb version with `pam_usb --version` or your package manager's query, and compare against the fixed version below.\n- Look for the pam_usb module in PAM configuration files under `/etc/pam.d/` to confirm it is in use.","fix":"- pam_usb: upgrade to `0.9.3` or later.","status":"open","published_at":"2026-11-11T05:19:50+00:00","first_seen_at":"2026-11-11T05:25:39+00:00","triaged_at":"2026-11-11T05:26:46+00:00","updated_at":"2026-11-11T05:26:46+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T05:26:46Z","model":"claude-haiku-5-5","output":{"fix":"- pam_usb: upgrade to `0.9.3` or later.","reach":"local","title":"pam_usb: buffer over-read in Linux login authentication can crash PAM","impact":"low","summary":"pam_usb is a PAM module that lets removable media unlock Linux logins. A missing string terminator in its command-line reader lets strstr scan past a heap buffer, which can crash the PAM process.","audience":"businesses","category":"package","nicknames":[],"who_cares":["linux","pam","pam_usb"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"hostile heap layout crashes the host PAM process; limited info disclosure","analyst_note":"","how_to_check":"- Check the installed pam_usb version with `pam_usb --version` or your package manager's query, and compare against the fixed version below.\n- Look for the pam_usb module in PAM configuration files under `/etc/pam.d/` to confirm it is in use.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["pam-usb-not-configured"],"who_is_affected":"Systems that use pam_usb for PAM authentication, with DISPLAY set during login, are exposed when running a version before 0.9.3. The read fires for every process at auth time, so any host with pam_usb configured in PAM is in scope. Hosts that do not use pam_usb in their PAM stack can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000749,"input_tokens":4766,"output_tokens":544,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-64667':16A,19A '/cmdline':95C '/proc':94C '0.9.3':74C,192C '2':106C '4096':84C,91C,109C 'alloc':82C,131C 'auth':153C 'authent':10A,65C,140C 'boolean':162C 'bound':157C 'boundari':132C 'buffer':3A,54B,87C,118C 'byte':85C,92C,110C 'call':127C 'cmdline':86C 'command':45B 'command-lin':44B 'consequ':155C 'crash':12A,57B 'cve':14A,17A 'disclosur':168C 'display':80C,142C 'end':119C 'everi':98C,150C 'exact':108C 'fire':148C 'function':115C,134C 'get':77C 'hardwar':64C 'heap':53B,173C 'host':182C 'hostil':172C 'info':167C 'info-disclosur':166C 'inspect':116C 'invok':136C 'issu':186C 'layout':174C 'let':32B,48B 'limit':165C 'line':46B 'linux':8A,20B,36B,67C 'login':9A,37B 'match':164C 'media':34B,70C 'miss':39B 'modul':30B 'normal':138C 'nul':99C 'output':159C 'over-read':4A 'packag':21B 'pam':1A,13A,22B,23B,25B,29B,59B,61C,139C,183C 'past':51B,129C 'patch':189C 'prior':71C 'process':60B,113C,151C,184C 'produc':176C 'provid':63C 'pusb':76C 'read':6A,88C,105C,147C 'reader':47B 'remov':33B,69C 'replac':97C 'return':107C 'scan':50B,128C 'separ':100C 'server':81C 'set':144C 'sigsegv':178C 'space':103C 'src/local.c':75C 'string':40B 'strstr':49B,126C,158C 'subsequ':125C 'substr':163C 'surfac':169C 'termin':41B,122C,180C 'time':154C 'tti':78C 'unlock':35B 'usb':2A,24B,26B,62C 'use':68C 'version':73C,191C 'without':120C","nicknames":[],"mitigations":[],"who_affected":"Systems that use pam_usb for PAM authentication, with DISPLAY set during login, are exposed when running a version before 0.9.3. The read fires for every process at auth time, so any host with pam_usb configured in PAM is in scope. Hosts that do not use pam_usb in their PAM stack can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["linux","medium","package","pam","pamusb"],"campaign_type":null,"search_a":"'-2026':15A,18A '-64667':16A,19A 'authent':10A 'buffer':3A 'crash':12A 'cve':14A,17A 'linux':8A 'login':9A 'over-read':4A 'pam':1A,13A 'read':6A 'usb':2A","search_b":"'buffer':54B 'command':45B 'command-lin':44B 'crash':57B 'heap':53B 'let':32B,48B 'line':46B 'linux':20B,36B 'login':37B 'media':34B 'miss':39B 'modul':30B 'packag':21B 'pam':22B,23B,25B,29B,59B 'past':51B 'process':60B 'reader':47B 'remov':33B 'scan':50B 'string':40B 'strstr':49B 'termin':41B 'unlock':35B 'usb':24B,26B","search_c":"'/cmdline':95C '/proc':94C '0.9.3':74C,192C '2':106C '4096':84C,91C,109C 'alloc':82C,131C 'auth':153C 'authent':65C,140C 'boolean':162C 'bound':157C 'boundari':132C 'buffer':87C,118C 'byte':85C,92C,110C 'call':127C 'cmdline':86C 'consequ':155C 'disclosur':168C 'display':80C,142C 'end':119C 'everi':98C,150C 'exact':108C 'fire':148C 'function':115C,134C 'get':77C 'hardwar':64C 'heap':173C 'host':182C 'hostil':172C 'info':167C 'info-disclosur':166C 'inspect':116C 'invok':136C 'issu':186C 'layout':174C 'limit':165C 'linux':67C 'match':164C 'media':70C 'normal':138C 'nul':99C 'output':159C 'pam':61C,139C,183C 'past':129C 'patch':189C 'prior':71C 'process':113C,151C,184C 'produc':176C 'provid':63C 'pusb':76C 'read':88C,105C,147C 'remov':69C 'replac':97C 'return':107C 'scan':128C 'separ':100C 'server':81C 'set':144C 'sigsegv':178C 'space':103C 'src/local.c':75C 'strstr':126C,158C 'subsequ':125C 'substr':163C 'surfac':169C 'termin':122C,180C 'time':154C 'tti':78C 'usb':62C 'use':68C 'version':73C,191C 'without':120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-02T15:05:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-64667","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64667","severity":null,"published_at":"2026-11-11T05:19:50+00:00","modified_at":"2026-11-11T05:19:50+00:00","first_seen_at":"2026-11-11T05:25:39+00:00","fetched_at":"2026-11-11T05:25:39+00:00","note":null}],"documents":[{"id":122862,"url":"https://github.com/mcdope/pam_usb/commit/d0a2e716241304cdb069adfaf54d2ede629d57fa","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":122860,"url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":122864,"url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-gc6f-5hpq-ghxh","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T15:05:45+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}