Buffer Overflow in pam_usb Hardware Authentication for Linux

CVE-2026-64667

What is CVE-2026-64667?

The pam_usb authentication module for Linux contains a buffer overflow vulnerability that arises from improper handling of input within the cmdline buffer. Specifically, the function 'pusb_get_tty_from_display_server' allocates a buffer and, upon reading from the /proc/cmdline, may write beyond the buffer's allocated size if it receives exactly 4096 bytes without a terminating character. This flaw can lead to exploitation during normal PAM authentication processes, as it is invoked regularly when DISPLAY is set. Although the risk of information disclosure is limited, an attacker may arrange heap memory in a way that causes a segmentation fault, resulting in a crash of the PAM process. Users are encouraged to upgrade to version 0.9.3 or higher, where this issue has been addressed.

References