Hardware Authentication Vulnerability in pam_usb by mcdope

CVE-2026-48792

What is CVE-2026-48792?

The pam_usb hardware authentication module for Linux, prior to version 0.9.1, contains a significant flaw that fails to properly handle EACCES errors when accessing /dev/input/event* nodes. This oversight allows the module to inaccurately report the absence of virtual input devices, leading to potential security breaches during the authentication process. The lack of appropriate error handling results in continued authentication attempts despite insufficient permissions, ultimately compromising system integrity. Users are urged to upgrade to version 0.9.1 or later to mitigate this vulnerability.

References