Denial of Service Vulnerability in pam_usb Hardware Authentication for Linux

CVE-2026-48986

What is CVE-2026-48986?

The pam_usb component, used for hardware authentication on Linux via removable media, is susceptible to a denial of service issue in versions 0.9.1 and earlier. The vulnerability arises from a failure to initialize a specific processing identifier during the authentication process. In particular, if the system is unable to read the process information (such as when an ancestor process exits unexpectedly), this can lead to an infinite loop that suspends the entire authentication process—including commands like sudo, sshd, or login—until it is forcibly terminated. This issue has been resolved in version 0.9.2, where updates to the code ensure proper handling of process identifiers and prevent such hangs during authentication.

References