CVE-2026-48985

{
  "id": "CVE-2026-48985",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-18T18:16:19.660",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_loginctl_local() can cause a NULL dereference crash when parsing loginctl output. The function calls popen() and reads the result; if the Remote field is only a newline, fgets() succeeds but strtok_r(buf, \"\\n\", &saveptr) returns NULL. A subsequent strcmp(is_remote, \"no\") then dereferences NULL, causing undefined behavior (typically SIGSEGV) and crashing the PAM module. This can crash the authenticating process (e.g., sudo, login) and, depending on PAM stack configuration, deny access for all users of the affected service. This issue has been fixed in version 0.9.2."
    },
    {
      "lang": "es",
      "value": "pam_usb proporciona autenticación de hardware para Linux utilizando medios extraíbles ordinarios. En las versiones 0.9.1 e inferiores, pusb_is_loginctl_local() puede causar un fallo por desreferencia de NULL al analizar la salida de loginctl. La función llama a popen() y lee el resultado; si el campo Remote es solo un salto de línea, fgets() tiene éxito pero strtok_r(buf, “\\n”, &saveptr) devuelve NULL. Un posterior strcmp(is_remote, “no”) entonces desreferencia NULL, causando un comportamiento indefinido (típicamente SIGSEGV) y bloqueando el módulo PAM. Esto puede bloquear el proceso de autenticación (p. ej., sudo, login) y, dependiendo de la configuración de la pila PAM, denegar el acceso a todos los usuarios del servicio afectado. Este problema ha sido solucionado en la versión 0.9.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "mcdope",
          "product": "pam_usb",
          "versions": [
            {
              "version": "< 0.9.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-18T19:08:54.015120Z",
          "id": "CVE-2026-48985",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/mcdope/pam_usb/releases/tag/0.9.2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-7j6h-wfc2-mg5q",
      "source": "[email protected]"
    }
  ]
}