Shell Injection in pam_usb Hardware Authentication for Linux

CVE-2026-44713

What is CVE-2026-44713?

In pam_usb, a hardware authentication system for Linux, a vulnerability exists prior to version 0.8.7 that allows for shell command injection. Specifically, in the src/tmux.c file, the user's $TMUX environment variable is read and improperly handled. The socket-path component is directly interpolated into a shell command without sufficient sanitization, facilitating the injection of arbitrary shell syntax if the variable includes a double-quote. This vulnerability poses a significant risk as the popen() function executes with root privileges within the PAM stack, which could lead to unauthorized access and control over the system.

References