Stack-based Buffer Overflow in pam_usb for Linux Affects Removable Media Authentication

CVE-2026-44710

What is CVE-2026-44710?

The pam_usb library enables hardware authentication for Linux systems using common removable media. Prior to version 0.8.7, a flaw allowed the software to pass the return values of specific drive accessors directly to comparison functions without performing necessary NULL checks. According to the documentation for the GIO/UDisks API, these accessors can indeed return NULL, creating potential scenarios for undefined behavior such as application crashes. This issue is addressed in version 0.8.7, which implements safeguards against passing NULL values.

References