CVE-2026-64667

pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c (pusb_get_tty_from_display_server) allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separator with a space. When read(2) returns exactly 4096 bytes for any process the function inspects, the buffer ends without a terminator and the subsequent strstr() calls scan past the allocation boundary. The function is invoked during normal PAM authentication when DISPLAY is set, so the read fires for every process at auth time. Consequences are bounded: strstr output is a Boolean substring match (limited info-disclosure surface) but a hostile heap layout can produce a SIGSEGV that terminates the host PAM process. This issue has been patched in version 0.9.3.

• CWE-125

• https://github.com/mcdope/pam_usb/commit/d0a2e716241304cdb069adfaf54d2ede629d57fa
• https://github.com/mcdope/pam_usb/issues/411
• https://github.com/mcdope/pam_usb/pull/426
• https://github.com/mcdope/pam_usb/releases/tag/0.9.3
• https://github.com/mcdope/pam_usb/security/advisories/GHSA-gc6f-5hpq-ghxh

Published

Nov 11, 2026

Last Modified

Nov 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-64657Budibase is an open-source low-code platform. Prior to 3.39.…8.4
• CVE-2026-64662Statamic is a Laravel and Git powered content management sys…6.5
• CVE-2026-64663Statamic is a Laravel and Git powered content management sys…6.5
• CVE-2026-64664Statamic is a Laravel and Git powered content management sys…4.3
• CVE-2026-64665Statamic is a Laravel and Git powered content management sys…8.1
• CVE-2026-64666pam_usb provides hardware authentication for Linux using rem…7.1
• CVE-2026-64668pam_usb provides hardware authentication for Linux using rem…7.4
• CVE-2026-64669pam_usb provides hardware authentication for Linux using rem…7.4
• CVE-2026-64670Waline is a comment system with backend support. In versions…9.3
• CVE-2026-64671Waline is a comment system with backend support. In versions…7.2
• CVE-2026-64672Terragrunt is a flexible orchestration tool that allows Infr…4.4
• CVE-2026-64676Kata Containers is an open source implementation of lightwei…5.7