Remote Authentication Flaw in pam_usb Affects Linux Devices
CVE-2026-64669

7.4HIGH

Key Information:

Vendor

Mcdope

Status
Pam Usb
Vendor
CVE Published:
11 November 2026

What is CVE-2026-64669?

The pam_usb module, a hardware authentication tool for Linux, contains a vulnerability in its deny_remote feature. This flaw arises from a regex pattern that fails to match IPv6 addresses written in compressed notation. As a result, even if a user has an active remote tmux session, the system may erroneously report 'no remote clients', allowing unauthorized access under certain conditions. This issue has been addressed in the subsequent release, version 0.9.3.

Affected Version(s)

pam_usb >= 0.8.0, < 0.9.3

References

https://github.com/mcdope/pam_usb/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/mcdope/pam_usb/pull/423
x_refsource_MISC
https://github.com/mcdope/pam_usb/commit/a62513f3da871d65...
x_refsource_MISC

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.