Local Denial of Service in pam_usb Authentication Module for Linux

CVE-2026-47271

What is CVE-2026-47271?

The pam_usb authentication module for Linux systems is vulnerable to a local denial-of-service attack due to improper handling of memory allocation failures. In versions prior to 0.9.0, the module lacked adequate guards against NULL pointer dereferences during memory allocation processes. When memory allocation fails, the module would crash, leading to authentication failures for users relying on the PAM module for login and sudo. This behavior creates a window of opportunity for attackers to lock users out of critical system features by inducing memory pressure. The vulnerability is effectively mitigated in version 0.9.0.

References