Security Flaw in pam_usb Causing Access Issues for Remote Sessions
CVE-2026-64668
7.4HIGH
What is CVE-2026-64668?
The pam_usb module, which provides hardware authentication for Linux using removable media, contains a vulnerability affecting versions from 0.8.0 to before 0.9.3. The 'deny_remote' feature utilizes '/usr/bin/w -i' to verify if the user has an active remote tmux session. However, due to a regex pattern mismatch in the IPv6 address detection, users with multi-homed network interfaces might bypass remote session checks, inadvertently granting unauthorized access. This issue has been resolved in version 0.9.3, emphasizing the need for updates to ensure robust security.
Affected Version(s)
pam_usb >= 0.8.0, < 0.9.3