CVE-2026-47270
- Source
- https://cve.org/CVERecord?id=CVE-2026-47270
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47270.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-47270
- Aliases
-
- GHSA-j3xw-vc43-x7jg
- Published
- 2026-05-27T20:10:37.108Z
- Modified
- 2026-07-22T00:04:11.957315Z
- Severity
-
- 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- pam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote result
- Details
-
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pamusb is a PAM module loaded into the host process (sudo, login, GDM, GNOME Shell). Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the denyremote feature called the non-reentrant strtok(), which stores state in a single global pointer. If two authentications race, one thread's strtok() call can overwrite the other's in-progress tokenisation pointer, causing incorrect parsing of the tmux session data or the /proc environ scan that backs the remote-session detection logic. Additionally, pusbtmuxgetclienttty() passed the raw pointer returned by getenv(TMUX) directly to strtok(). getenv() returns a pointer into the live process environment block; strtok() inserts NUL bytes into that block, permanently corrupting the TMUX variable for subsequent code running in the same process. In long-lived display managers this affects all future authentications in that process. The combined effect can cause denyremote=true to return an incorrect decision for a remote session, or an incorrect decision for a local session, depending on thread interleaving. This vulnerability is fixed in 0.9.0.
- Database specific
{ "cwe_ids": [ "CWE-362" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47270.json", "cna_assigner": "GitHub_M" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47270.json
- https://github.com/mcdope/pam_usb/security/advisories/GHSA-j3xw-vc43-x7jg
- https://nvd.nist.gov/vuln/detail/CVE-2026-47270
- https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51
- https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd
Affected packages
Git / github.com/mcdope/pam_usb
Database specific
vanir_signatures_modified
"2026-07-22T00:04:11Z"
vanir_signatures
[
{
"signature_type": "Line",
"target": {
"file": "src/tmux.c"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-046097da",
"signature_version": "v1",
"digest": {
"line_hashes": [
"262911015990322610702261089155261249682",
"5266001408631339088761356107814227983",
"291349440928906439699371008382326232311",
"225096573628138229947618687053623765928",
"262578963839469867474635328202858259656",
"311712118371910535799835830521274556888",
"7379981111785203850979097694115606253",
"112892583337373005659928768866861990416",
"249739417969245992654643752823721289652",
"157755383342522050090306436053927844186",
"177093855106373658117775109180341948895",
"192666591260830817986478220132790010265",
"216578758083005068791126096364021710730",
"336987300098518302550111016658372169877",
"101069065376998439565468922105033208124",
"286771843561252693377998359571269102801",
"163695927965898342024249099361292943945",
"285949206004630724530471896398341150112",
"287273177978117498079018578162762118363",
"166516778117059356158618559805285084172",
"183508843659844739825072715948796063681",
"206368726984246892816477624709972316217",
"6109587750457056552849770597554481269",
"19496250595211965295999435584057022448",
"49847285256359794278916376495824307659",
"281863570764585495241308357858122455530",
"170208828891162154812528372610552496054",
"279379735731478962668002509252962486529",
"112152214440022389867754951954322884630",
"177460802482926588248769178317273325790",
"65258931473368097914871043960095430273",
"187696419268926468345466960682922156445",
"68575082185330477995091765389589651169",
"183682804171076640625010812448521690496",
"335106596199974288256242371191420267461",
"275926368653739390620423436200624622828",
"218286113397337799703126256186044663387",
"337760362337746022005964915234376720560",
"164321562254855354759736624186201526907",
"51064445421604946937433164556113474154",
"290585921949763765262018930552698757702",
"114953744071630133535866603028919343327",
"230643492342550391116044953351131883734",
"27671880819215563947492383921065479247",
"91739694373327120425202651805904071218",
"247117775867240821435708797971878398957",
"35159466061848887496965386376049141252",
"288103764160444775684599972474944878986",
"40050758366600950278498653531163955347",
"148776272078089211531841737178032672790",
"280023093754470373868261624931988084299",
"266456732266638609151505188293053155290",
"128668682274606412648903077518059573198",
"237490922104409067314785161878673905843",
"324676600675885778586373217150812568285",
"193078671918961018790561220794490247008",
"21568872757727452550738615936181255089",
"109649874748748727435644786329122003446",
"324774207079177244358917404630644437778"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "tests/unit/c/process_test.c"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-0e04c7ce",
"signature_version": "v1",
"digest": {
"line_hashes": [
"197458212444380363295428787952517314852",
"208137722568255458053890653271638898988",
"96249688255229574990695498906277129507",
"58009843163394029378340693699999721745",
"315248826870388833338456291117440162116",
"163745894376564430582041935690794676227",
"86145721126598957970403503943064853810"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "src/local.c",
"function": "pusb_is_loginctl_local"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-32acab7c",
"signature_version": "v1",
"digest": {
"function_hash": "118540602697610104929992365223003157868",
"length": 884.0
}
},
{
"signature_type": "Function",
"target": {
"file": "src/tmux.c",
"function": "pusb_tmux_get_client_tty"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-4301ba9a",
"signature_version": "v1",
"digest": {
"function_hash": "203600649413043455361259512633942592934",
"length": 2058.0
}
},
{
"signature_type": "Line",
"target": {
"file": "src/device.c"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-518d2dc3",
"signature_version": "v1",
"digest": {
"line_hashes": [
"278902535416286447839924323833110399795",
"155960015283809876256569423692780497469",
"237186881707854572189504021530801782522",
"324700451312078704143184272489979717709",
"2203622478053677454702293863439406127",
"293138842475019692111680913641234356407",
"239623305770701901212045270447896656190",
"160447442901675626721800280640016890792",
"49777132974118063815685655147469448088"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "src/local.c"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-52a28c32",
"signature_version": "v1",
"digest": {
"line_hashes": [
"147934107663606388051006008125952921126",
"92337529215530401553032780474864361394",
"44707840582841626741769719373809258129",
"306461306008319159495108460418593378389",
"169912879667732806491207472292876005467",
"182567202058999392240928796821204878721",
"182320077821759376365141273982877851617",
"298847941396691813126217917940169498402",
"66753971756900225045462776813821731636",
"152124220399182528725536825348353698508",
"212886880883270955472712518291380203693",
"35333448975581889925330522044894250858",
"168389655503624393025663654987294695421",
"193695462715558860524164204422766006860",
"204645581565996732624785769335368179902",
"161273255475203899743091087373458844282"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "src/pad.c",
"function": "pusb_pad_update"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-6934f5f8",
"signature_version": "v1",
"digest": {
"function_hash": "63512548676523806955687189769095979786",
"length": 3119.0
}
},
{
"signature_type": "Function",
"target": {
"file": "src/local.c",
"function": "pusb_is_tty_local"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-69c6ffc2",
"signature_version": "v1",
"digest": {
"function_hash": "53001927620320481193486326141190240804",
"length": 867.0
}
},
{
"signature_type": "Line",
"target": {
"file": "src/process.c"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-735594b3",
"signature_version": "v1",
"digest": {
"line_hashes": [
"37852091618285221852330457908219665427",
"229929867358431245951844013405192999723",
"139274644599127365813573838886725190632",
"261217959750407315900978100219828723970",
"90436370490808044441896508279341347416",
"256946047910976823222698117872995207111",
"135724283148473709760848591736763767981",
"72354123135146967683427777072920094160",
"52783421829893770835852271021436454805",
"279318470609240378651878974597517541571",
"192294339745684637749809913669832386122",
"14703187207152817555848996366957102190"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "src/pad.c"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-74dcd252",
"signature_version": "v1",
"digest": {
"line_hashes": [
"94903299979483815936981700935042760496",
"100311666774101747484908858465731122408",
"336533102673951163000546088809064524562",
"88477740023413976462308541912778193833",
"17062292484768571178449548993950666756",
"152321812389447110531910390168578424998",
"182879399887190052788011996914165077003",
"232838246175202634809163413973300233811",
"87766368119499752042584661591121604667",
"75155788891650128956810404311642681607",
"210479684777317256413100721194467395375",
"209767839312200780141492242634499408418",
"17291579197998356607189659803492620856",
"72791364970238907284709093667903771536",
"224291528485295405291870900335496438800",
"168158448865850392446694776052270007871",
"207208252093947032464690614405967485679",
"338759544048713327444817565478461680236",
"87502584103955288744030655986439995310",
"291997586007469813865494788274821506072",
"303058120691191719290591507491580054753",
"270755086200780821924791656032268740507",
"155965411607868335577653248627884621775",
"232766157788758291574734060316795294166",
"184960450536297230053600601640610210300"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "src/device.c",
"function": "pusb_device_connected"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-807f3639",
"signature_version": "v1",
"digest": {
"function_hash": "219666381063073677475353283537575248100",
"length": 2216.0
}
},
{
"signature_type": "Function",
"target": {
"file": "src/local.c",
"function": "pusb_get_tty_by_loginctl"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-813901ce",
"signature_version": "v1",
"digest": {
"function_hash": "108693028144790148875812204470552216634",
"length": 926.0
}
},
{
"signature_type": "Line",
"target": {
"file": "tests/unit/c/pad_test.c"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51",
"id": "CVE-2026-47270-84abbc09",
"signature_version": "v1",
"digest": {
"line_hashes": [
"103043566955760231311265397091135496595",
"41210646900460086679233014620339679688",
"95363177011039510507650388920785764417",
"332421449890385902882317846752794141746",
"13389970975463208967150958338674760090",
"94830844597113089334161359174017474885",
"30931317114101636730826147037243696785"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "src/mem.c",
"function": "xrealloc"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-869f2770",
"signature_version": "v1",
"digest": {
"function_hash": "141700857347142188511384482832760219899",
"length": 161.0
}
},
{
"signature_type": "Function",
"target": {
"file": "tests/unit/c/process_test.c",
"function": "main"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-9c77c14b",
"signature_version": "v1",
"digest": {
"function_hash": "98111767787322465915364467208934293295",
"length": 731.0
}
},
{
"signature_type": "Function",
"target": {
"file": "tests/unit/c/pad_test.c",
"function": "main"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51",
"id": "CVE-2026-47270-9ff84d0d",
"signature_version": "v1",
"digest": {
"function_hash": "8179206408387355548549305931699477801",
"length": 708.0
}
},
{
"signature_type": "Line",
"target": {
"file": "src/mem.c"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-acf03f64",
"signature_version": "v1",
"digest": {
"line_hashes": [
"311482001624001483380926476158430264275",
"46066139881279367702595913081945114239",
"95495177443689330961560508545687142326",
"146107011773348669792776997142552107150",
"256863636340554980631050045578996607405",
"16846325328480568452821454256812006424",
"31937643072928917594498453896700783769",
"53430278062263847868268972235147502862",
"107925962242929147665209654584403381129",
"257987689222714781086777781387135920703",
"138022992293149923614431035114877080298",
"150328458956740517311228598412547178758",
"257548387611727911777533043283299226765",
"219943424528155585785360705812332463092",
"280111740837792367915351475600947684271"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "src/mem.c",
"function": "xstrdup"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-c76222e2",
"signature_version": "v1",
"digest": {
"function_hash": "299886335175012807100282676890286341151",
"length": 144.0
}
},
{
"signature_type": "Function",
"target": {
"file": "src/local.c",
"function": "pusb_get_tty_from_display_server"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-cadccfd6",
"signature_version": "v1",
"digest": {
"function_hash": "69657029001219523897740521195009473994",
"length": 2279.0
}
},
{
"signature_type": "Line",
"target": {
"file": "tests/unit/c/tmux_test.c"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-cd28597c",
"signature_version": "v1",
"digest": {
"line_hashes": [
"232063608063545694251461812487647294996",
"135399071238016763047535409142022088406",
"96249688255229574990695498906277129507",
"272524994958922618277235637913735398983",
"190314764333791239212371207457555990678",
"167730370991931416403533887945494627685",
"216824450044806261731370335210800381443"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "src/mem.c",
"function": "xmalloc"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-d676ab81",
"signature_version": "v1",
"digest": {
"function_hash": "192607803440488861342048580638874554237",
"length": 136.0
}
},
{
"signature_type": "Function",
"target": {
"file": "src/pad.c",
"function": "pusb_pad_should_update"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-ec2c05f4",
"signature_version": "v1",
"digest": {
"function_hash": "232135772049704262345430493436889995749",
"length": 806.0
}
},
{
"signature_type": "Function",
"target": {
"file": "src/process.c",
"function": "pusb_get_process_envvar"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-f733508c",
"signature_version": "v1",
"digest": {
"function_hash": "38834797829152044862613013635930741978",
"length": 712.0
}
},
{
"signature_type": "Function",
"target": {
"file": "tests/unit/c/tmux_test.c",
"function": "main"
},
"deprecated": false,
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"id": "CVE-2026-47270-fe298972",
"signature_version": "v1",
"digest": {
"function_hash": "285048067924611644664548215597881830367",
"length": 1172.0
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47270.json"