PAM_USB · CVE-2026-64668 · Other
NO FIX YET · SEE WHAT TO DO
pam_usb's deny_remote check misses remote tmux sessions whose link-local IPv6 address carries a zone index such as %eth0. When the match fails, the module reports no remote clients and grants access that deny_remote should block.
first public Jul 2, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Linux systems that use pam_usb for USB-token authentication with the deny_remote option enabled, where users reach tmux sessions over IPv6 on multi-homed interfaces. Systems on pam_usb 0.9.3 or later, or without deny_remote, are not exposed by this flaw.
Not affected if deny-remote-disabled, no-ipv6-remote-sessions, version-0.9.3-or-later
Who cares ipv6, linux, pam, pam-usb, ssh, tmux
0.8.0 or later but before 0.9.3.deny_remote feature is enabled in your pam_usb configuration.0.9.3 or later.pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tmux_has_remote_clients() (src/tmux.c), the IPv6 detection pattern matched the address group and then immediately expected whitespace. On Linux systems with multi-homed network interfaces, w -i appends a zone index (scope identifier) to link-local IPv6 addresses — e.g. fe80::1%eth0. The %eth0 suffix appeared between the address and the next whitespace field, causing the regex match to fail even for an otherwise-matching remote session. The function returned "no remote clients" and granted access. This issue has been patched in version 0.9.3.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.