{"id":"CVE-2026-64669","kind":"vulnerability","aliases":["CVE-2026-64669"],"related":[],"title":"pam_usb: deny_remote check misses remote tmux users on compressed IPv6","description":"pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tmux_has_remote_clients() (src/tmux.c), the IPv6 detection regex required exactly four explicit colon-separated groups of 1-4 hex digits (e.g. 2001:0db8:85a3:0000). Any IPv6 address in compressed notation — including loopback (::1), link-local (fe80::1), and global unicast addresses (2001:db8::1) — did not match this pattern. As a result the remote-client check silently returned \"no remote clients\" even when a remote tmux client was connected from such an address. This issue has been patched in version 0.9.3.","summary":"pam_usb's deny_remote setting is meant to block hardware-key login when the user has a remote tmux session, but its IPv6 parser only recognizes fully written addresses. A remote tmux client connecting from a compressed IPv6 address such as ::1 or 2001:db8::1 goes undetected, so the check reports no remote clients.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ipv6","linux","package","pam","pam-usb","tmux"],"not_affected_if":["default-config","pam-usb-0.9.3-or-later","pam-usb-below-0.8.0"],"how_to_check":"- Check the installed pam_usb version and whether it is between `0.8.0` and `0.9.3`.\n- Look for `deny_remote` enabled in the pam_usb configuration (`/etc/security/pam_usb.conf`).\n- Check whether users run tmux sessions that accept remote clients over IPv6.","fix":"- pam_usb: upgrade to `0.9.3` or later.","status":"open","published_at":"2026-11-11T05:19:51+00:00","first_seen_at":"2026-11-11T05:25:40+00:00","triaged_at":"2026-11-11T05:26:35+00:00","updated_at":"2026-11-11T05:26:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T05:26:35Z","model":"claude-haiku-5-5","output":{"fix":"- pam_usb: upgrade to `0.9.3` or later.","reach":"network","title":"pam_usb: deny_remote check misses remote tmux users on compressed IPv6","impact":"medium","summary":"pam_usb's deny_remote setting is meant to block hardware-key login when the user has a remote tmux session, but its IPv6 parser only recognizes fully written addresses. A remote tmux client connecting from a compressed IPv6 address such as ::1 or 2001:db8::1 goes undetected, so the check reports no remote clients.","audience":"developers","category":"package","nicknames":[],"who_cares":["linux","pam","pam-usb","tmux","ipv6"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Remote tmux session bypasses deny_remote and hardware-key login proceeds","analyst_note":"","how_to_check":"- Check the installed pam_usb version and whether it is between `0.8.0` and `0.9.3`.\n- Look for `deny_remote` enabled in the pam_usb configuration (`/etc/security/pam_usb.conf`).\n- Check whether users run tmux sessions that accept remote clients over IPv6.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","pam-usb-below-0.8.0","pam-usb-0.9.3-or-later"],"who_is_affected":"Only systems running pam_usb from 0.8.0 up to but not including 0.9.3 with deny_remote enabled are exposed. The flaw matters where users reach tmux over IPv6 and the deny_remote rule is relied on to block hardware-key logins from remote sessions. Systems without deny_remote, or without IPv6 remote tmux clients, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000809,"input_tokens":4759,"output_tokens":667,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-4':144C '-64669':15A,18A '/usr/bin/w':109C '0.8.0':96C '0.9.3':100C,210C '0000':151C '0db8':149C '1':70B,74B,143C,160C,165C,172C '2001':72B,148C,170C '85a3':150C 'activ':119C 'address':57B,67B,154C,169C,202C 'authent':88C,115C 'block':36B 'check':5A,79B,185C 'client':61B,83B,128C,184C,190C,196C 'colon':139C 'colon-separ':138C 'compress':11A,65B,156C 'connect':62B,198C 'cve':13A,16A 'db8':73B,171C 'deni':3A,30B,102C 'detect':112C,132C 'digit':146C 'e.g':147C 'even':191C 'exact':135C 'explicit':137C 'fe80':164C 'featur':104C 'four':136C 'fulli':55B 'global':167C 'goe':75B 'group':141C 'hardwar':38B,87C 'hardware-key':37B 'hex':145C 'includ':158C 'ipv6':12A,19B,51B,66B,131C,153C 'issu':204C 'key':39B 'link':162C 'link-loc':161C 'linux':20B,90C 'local':163C 'login':40B 'loopback':159C 'match':175C 'meant':34B 'media':93C 'miss':6A 'notat':157C 'packag':21B 'pam':1A,22B,24B,27B,84C,106C 'pam-usb':23B 'parser':52B 'patch':207C 'pattern':177C 'provid':86C 'pusb':124C 'recogn':54B 'regex':133C 'remot':4A,7A,31B,46B,59B,82B,103C,120C,127C,183C,189C,194C 'remote-cli':182C 'remov':92C 'report':80B 'requir':134C 'result':180C 'return':187C 'separ':140C 'session':48B,122C 'set':32B 'silent':186C 'src/tmux.c':129C 'tmux':8A,26B,47B,60B,121C,125C,195C 'undetect':76B 'unicast':168C 'usb':2A,25B,28B,85C,107C 'use':91C,108C 'user':9A,43B,116C 'version':95C,99C,209C 'whether':113C 'written':56B","nicknames":[],"mitigations":[],"who_affected":"Only systems running pam_usb from 0.8.0 up to but not including 0.9.3 with deny_remote enabled are exposed. The flaw matters where users reach tmux over IPv6 and the deny_remote rule is relied on to block hardware-key logins from remote sessions. Systems without deny_remote, or without IPv6 remote tmux clients, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","ipv6","linux","package","pam","pamusb","tmux"],"campaign_type":null,"search_a":"'-2026':14A,17A '-64669':15A,18A 'check':5A 'compress':11A 'cve':13A,16A 'deni':3A 'ipv6':12A 'miss':6A 'pam':1A 'remot':4A,7A 'tmux':8A 'usb':2A 'user':9A","search_b":"'1':70B,74B '2001':72B 'address':57B,67B 'block':36B 'check':79B 'client':61B,83B 'compress':65B 'connect':62B 'db8':73B 'deni':30B 'fulli':55B 'goe':75B 'hardwar':38B 'hardware-key':37B 'ipv6':19B,51B,66B 'key':39B 'linux':20B 'login':40B 'meant':34B 'packag':21B 'pam':22B,24B,27B 'pam-usb':23B 'parser':52B 'recogn':54B 'remot':31B,46B,59B,82B 'report':80B 'session':48B 'set':32B 'tmux':26B,47B,60B 'undetect':76B 'usb':25B,28B 'user':43B 'written':56B","search_c":"'-4':144C '/usr/bin/w':109C '0.8.0':96C '0.9.3':100C,210C '0000':151C '0db8':149C '1':143C,160C,165C,172C '2001':148C,170C '85a3':150C 'activ':119C 'address':154C,169C,202C 'authent':88C,115C 'check':185C 'client':128C,184C,190C,196C 'colon':139C 'colon-separ':138C 'compress':156C 'connect':198C 'db8':171C 'deni':102C 'detect':112C,132C 'digit':146C 'e.g':147C 'even':191C 'exact':135C 'explicit':137C 'fe80':164C 'featur':104C 'four':136C 'global':167C 'group':141C 'hardwar':87C 'hex':145C 'includ':158C 'ipv6':131C,153C 'issu':204C 'link':162C 'link-loc':161C 'linux':90C 'local':163C 'loopback':159C 'match':175C 'media':93C 'notat':157C 'pam':84C,106C 'patch':207C 'pattern':177C 'provid':86C 'pusb':124C 'regex':133C 'remot':103C,120C,127C,183C,189C,194C 'remote-cli':182C 'remov':92C 'requir':134C 'result':180C 'return':187C 'separ':140C 'session':122C 'silent':186C 'src/tmux.c':129C 'tmux':121C,125C,195C 'unicast':168C 'usb':85C,107C 'use':91C,108C 'user':116C 'version':95C,99C,209C 'whether':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-02T15:05:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-64669","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64669","severity":null,"published_at":"2026-11-11T05:19:51+00:00","modified_at":"2026-11-11T05:19:51+00:00","first_seen_at":"2026-11-11T05:25:40+00:00","fetched_at":"2026-11-11T05:25:40+00:00","note":null}],"documents":[{"id":122865,"url":"https://github.com/mcdope/pam_usb/commit/a62513f3da871d6576d751de3482eb80b9ac79f3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":122860,"url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":122870,"url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-gc4c-v52c-2v34","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T15:05:45+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}