---
id: "CVE-2026-64667"
page: "https://infrastack.ai/live/CVE-2026-64667"
kind: "vulnerability"
aliases: ["CVE-2026-64667"]
title: "pam_usb: buffer over-read in Linux login authentication can crash PAM"
severity: "medium"
cvss: 4.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["linux", "package", "pam", "pam_usb"]
not_affected_if: ["pam-usb-not-configured"]
published_at: "2026-11-11T05:19:50+00:00"
first_seen_at: "2026-11-11T05:25:39+00:00"
updated_at: "2026-11-11T05:26:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64667", "first_seen_at": "2026-11-11T05:25:39+00:00"}]
exploit_sources: []
---

# pam_usb: buffer over-read in Linux login authentication can crash PAM

Link for people: https://infrastack.ai/live/CVE-2026-64667 (this .md is for agents)

pam_usb is a PAM module that lets removable media unlock Linux logins. A missing string terminator in its command-line reader lets strstr scan past a heap buffer, which can crash the PAM process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed pam_usb version with `pam_usb --version` or your package manager's query, and compare against the fixed version below.
- Look for the pam_usb module in PAM configuration files under `/etc/pam.d/` to confirm it is in use.

## Fix

- pam_usb: upgrade to `0.9.3` or later.

## Timeline

- 2026-11-11T05:25:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64667

## Documents

- [advisory] Vendor advisory: github.com https://github.com/mcdope/pam_usb/security/advisories/GHSA-gc6f-5hpq-ghxh
- [fix] Patch: github.com https://github.com/mcdope/pam_usb/commit/d0a2e716241304cdb069adfaf54d2ede629d57fa
- [fix] Release notes: github.com https://github.com/mcdope/pam_usb/releases/tag/0.9.3

## From the sources

pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c (pusb_get_tty_from_display_server) allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separator with a space. When read(2) returns exactly 4096 bytes for any process the function inspects, the buffer ends without a terminator and the subsequent strstr() calls scan past the allocation boundary. The function is invoked during normal PAM authentication when DISPLAY is set, so the read fires for every process at auth time. Consequences are bounded: strstr output is a Boolean substring match (limited info-disclosure surface) but a hostile heap layout can produce a SIGSEGV that terminates the host PAM process. This issue has been patched in version 0.9.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_