Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.7
CVE-2026-48986: pam_usb can hang login when USB auth process ends
CVE-2026-48986 · published 4 months ago
Summary
The pam_usb tool used for USB key authentication on Linux may get stuck if a parent process ends while a user is logging in. This causes the login request (for example, sudo, SSH, or the console) to freeze until it is manually stopped. Updating to pam_usb version 0.9.2 or later resolves the issue.
Original advisory text
pam_usb: Infinite loop DoS in process-tree walk when parent process exits during authentication
pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 and earlier, usb_get_process_parent_id() can cause an infinite loop DoS because it does not initialize *ppid on failure. In pusb_local_login(), the same variable is reused as input and output in a process-tree while loop; if /proc/<pid>/stat cannot be read (for example, when an ancestor process exits during authentication), the PID is not updated and the loop does not terminate. This hangs the authenticating process (such as sudo, sshd, or login) until it is forcibly terminated. This issue has been fixed in version 0.9.2.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48986... Vendor Advisory
- https://github.com/mcdope/pam_usb/security/advisories/GHSA-h28h-9hc3-v595 Vendor Advisory
- https://github.com/mcdope/pam_usb/releases/tag/0.9.2 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-48986 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
Timeline
Published18 Jun 2026
Updated28 Oct 2026
First seen22 Jun 2026
Track software like this
Free during beta