CVE-2026-44710

MEDIUM

pam_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login denial-of-service

Title source: cna
STIX 2.1

Description

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model() directly to strcmp() without NULL checks. The GIO/UDisks API documentation states these accessors can return NULL for devices that do not expose the corresponding field. Passing NULL to strcmp() is undefined behaviour (typically a SIGSEGV). This vulnerability is fixed in 0.8.7.

References (1)

Core 1
Core References

Scores

CVSS v3 4.6
EPSS 0.0018
EPSS Percentile 7.5%
Attack Vector PHYSICAL
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-476
Status published
Products (1)
mcdope/pam_usb < 0.8.7
Published May 27, 2026
Tracked Since May 28, 2026