CVE-2026-47271
- Source
- https://cve.org/CVERecord?id=CVE-2026-47271
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47271.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-47271
- Aliases
-
- GHSA-7rvx-jcc6-7hqq
- Published
- 2026-05-27T20:08:02.552Z
- Modified
- 2026-08-12T16:25:23.012326Z
- Severity
-
- 5.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- pam_usb: OOM guards removed by -DNDEBUG cause NULL dereference and authentication process crash
- Details
-
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, src/mem.c implemented out-of-memory guards for xmalloc(), xrealloc(), and xstrdup() using assert(data != NULL). The C standard specifies that all assert() expressions are compiled out when NDEBUG is defined at build time. NDEBUG is commonly defined in release and packaging builds (Debian, Fedora, Arch package flags all define it via -DNDEBUG in CFLAGS). With the guard removed, xmalloc/xrealloc/xstrdup silently return NULL on allocation failure. Every caller in the codebase dereferences the return value without a NULL check -- this is the intended design, as the guard was supposed to abort before the dereference. With the guard gone, any allocation failure causes a NULL pointer dereference, crashing the PAM module. A crash in a PAM module loaded by sudo or login causes authentication to fail for the duration of the crash, creating a local denial-of-service condition. An attacker who can induce memory pressure at authentication time can lock all users out of sudo and login. This vulnerability is fixed in 0.9.0.
- Database specific
{ "cwe_ids": [ "CWE-476" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47271.json" }- References
Affected packages
Git / github.com/mcdope/pam_usb
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47271.json"
vanir_signatures
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"262911015990322610702261089155261249682",
"5266001408631339088761356107814227983",
"291349440928906439699371008382326232311",
"225096573628138229947618687053623765928",
"262578963839469867474635328202858259656",
"311712118371910535799835830521274556888",
"7379981111785203850979097694115606253",
"112892583337373005659928768866861990416",
"249739417969245992654643752823721289652",
"157755383342522050090306436053927844186",
"177093855106373658117775109180341948895",
"192666591260830817986478220132790010265",
"216578758083005068791126096364021710730",
"336987300098518302550111016658372169877",
"101069065376998439565468922105033208124",
"286771843561252693377998359571269102801",
"163695927965898342024249099361292943945",
"285949206004630724530471896398341150112",
"287273177978117498079018578162762118363",
"166516778117059356158618559805285084172",
"183508843659844739825072715948796063681",
"206368726984246892816477624709972316217",
"6109587750457056552849770597554481269",
"19496250595211965295999435584057022448",
"49847285256359794278916376495824307659",
"281863570764585495241308357858122455530",
"170208828891162154812528372610552496054",
"279379735731478962668002509252962486529",
"112152214440022389867754951954322884630",
"177460802482926588248769178317273325790",
"65258931473368097914871043960095430273",
"187696419268926468345466960682922156445",
"68575082185330477995091765389589651169",
"183682804171076640625010812448521690496",
"335106596199974288256242371191420267461",
"275926368653739390620423436200624622828",
"218286113397337799703126256186044663387",
"337760362337746022005964915234376720560",
"164321562254855354759736624186201526907",
"51064445421604946937433164556113474154",
"290585921949763765262018930552698757702",
"114953744071630133535866603028919343327",
"230643492342550391116044953351131883734",
"27671880819215563947492383921065479247",
"91739694373327120425202651805904071218",
"247117775867240821435708797971878398957",
"35159466061848887496965386376049141252",
"288103764160444775684599972474944878986",
"40050758366600950278498653531163955347",
"148776272078089211531841737178032672790",
"280023093754470373868261624931988084299",
"266456732266638609151505188293053155290",
"128668682274606412648903077518059573198",
"237490922104409067314785161878673905843",
"324676600675885778586373217150812568285",
"193078671918961018790561220794490247008",
"21568872757727452550738615936181255089",
"109649874748748727435644786329122003446",
"324774207079177244358917404630644437778"
]
},
"target": {
"file": "src/tmux.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-046097da",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"197458212444380363295428787952517314852",
"208137722568255458053890653271638898988",
"96249688255229574990695498906277129507",
"58009843163394029378340693699999721745",
"315248826870388833338456291117440162116",
"163745894376564430582041935690794676227",
"86145721126598957970403503943064853810"
]
},
"target": {
"file": "tests/unit/c/process_test.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-0e04c7ce",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "118540602697610104929992365223003157868",
"length": 884.0
},
"target": {
"function": "pusb_is_loginctl_local",
"file": "src/local.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-32acab7c",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "203600649413043455361259512633942592934",
"length": 2058.0
},
"target": {
"function": "pusb_tmux_get_client_tty",
"file": "src/tmux.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-4301ba9a",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"278902535416286447839924323833110399795",
"155960015283809876256569423692780497469",
"237186881707854572189504021530801782522",
"324700451312078704143184272489979717709",
"2203622478053677454702293863439406127",
"293138842475019692111680913641234356407",
"239623305770701901212045270447896656190",
"160447442901675626721800280640016890792",
"49777132974118063815685655147469448088"
]
},
"target": {
"file": "src/device.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-518d2dc3",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147934107663606388051006008125952921126",
"92337529215530401553032780474864361394",
"44707840582841626741769719373809258129",
"306461306008319159495108460418593378389",
"169912879667732806491207472292876005467",
"182567202058999392240928796821204878721",
"182320077821759376365141273982877851617",
"298847941396691813126217917940169498402",
"66753971756900225045462776813821731636",
"152124220399182528725536825348353698508",
"212886880883270955472712518291380203693",
"35333448975581889925330522044894250858",
"168389655503624393025663654987294695421",
"193695462715558860524164204422766006860",
"204645581565996732624785769335368179902",
"161273255475203899743091087373458844282"
]
},
"target": {
"file": "src/local.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-52a28c32",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "63512548676523806955687189769095979786",
"length": 3119.0
},
"target": {
"function": "pusb_pad_update",
"file": "src/pad.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-6934f5f8",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "53001927620320481193486326141190240804",
"length": 867.0
},
"target": {
"function": "pusb_is_tty_local",
"file": "src/local.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-69c6ffc2",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"37852091618285221852330457908219665427",
"229929867358431245951844013405192999723",
"139274644599127365813573838886725190632",
"261217959750407315900978100219828723970",
"90436370490808044441896508279341347416",
"256946047910976823222698117872995207111",
"135724283148473709760848591736763767981",
"72354123135146967683427777072920094160",
"52783421829893770835852271021436454805",
"279318470609240378651878974597517541571",
"192294339745684637749809913669832386122",
"14703187207152817555848996366957102190"
]
},
"target": {
"file": "src/process.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-735594b3",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"94903299979483815936981700935042760496",
"100311666774101747484908858465731122408",
"336533102673951163000546088809064524562",
"88477740023413976462308541912778193833",
"17062292484768571178449548993950666756",
"152321812389447110531910390168578424998",
"182879399887190052788011996914165077003",
"232838246175202634809163413973300233811",
"87766368119499752042584661591121604667",
"75155788891650128956810404311642681607",
"210479684777317256413100721194467395375",
"209767839312200780141492242634499408418",
"17291579197998356607189659803492620856",
"72791364970238907284709093667903771536",
"224291528485295405291870900335496438800",
"168158448865850392446694776052270007871",
"207208252093947032464690614405967485679",
"338759544048713327444817565478461680236",
"87502584103955288744030655986439995310",
"291997586007469813865494788274821506072",
"303058120691191719290591507491580054753",
"270755086200780821924791656032268740507",
"155965411607868335577653248627884621775",
"232766157788758291574734060316795294166",
"184960450536297230053600601640610210300"
]
},
"target": {
"file": "src/pad.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-74dcd252",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "219666381063073677475353283537575248100",
"length": 2216.0
},
"target": {
"function": "pusb_device_connected",
"file": "src/device.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-807f3639",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "108693028144790148875812204470552216634",
"length": 926.0
},
"target": {
"function": "pusb_get_tty_by_loginctl",
"file": "src/local.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-813901ce",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "141700857347142188511384482832760219899",
"length": 161.0
},
"target": {
"function": "xrealloc",
"file": "src/mem.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-869f2770",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "98111767787322465915364467208934293295",
"length": 731.0
},
"target": {
"function": "main",
"file": "tests/unit/c/process_test.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-9c77c14b",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"311482001624001483380926476158430264275",
"46066139881279367702595913081945114239",
"95495177443689330961560508545687142326",
"146107011773348669792776997142552107150",
"256863636340554980631050045578996607405",
"16846325328480568452821454256812006424",
"31937643072928917594498453896700783769",
"53430278062263847868268972235147502862",
"107925962242929147665209654584403381129",
"257987689222714781086777781387135920703",
"138022992293149923614431035114877080298",
"150328458956740517311228598412547178758",
"257548387611727911777533043283299226765",
"219943424528155585785360705812332463092",
"280111740837792367915351475600947684271"
]
},
"target": {
"file": "src/mem.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-acf03f64",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "299886335175012807100282676890286341151",
"length": 144.0
},
"target": {
"function": "xstrdup",
"file": "src/mem.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-c76222e2",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "69657029001219523897740521195009473994",
"length": 2279.0
},
"target": {
"function": "pusb_get_tty_from_display_server",
"file": "src/local.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-cadccfd6",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"232063608063545694251461812487647294996",
"135399071238016763047535409142022088406",
"96249688255229574990695498906277129507",
"272524994958922618277235637913735398983",
"190314764333791239212371207457555990678",
"167730370991931416403533887945494627685",
"216824450044806261731370335210800381443"
]
},
"target": {
"file": "tests/unit/c/tmux_test.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-cd28597c",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "192607803440488861342048580638874554237",
"length": 136.0
},
"target": {
"function": "xmalloc",
"file": "src/mem.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-d676ab81",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "232135772049704262345430493436889995749",
"length": 806.0
},
"target": {
"function": "pusb_pad_should_update",
"file": "src/pad.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-ec2c05f4",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "38834797829152044862613013635930741978",
"length": 712.0
},
"target": {
"function": "pusb_get_process_envvar",
"file": "src/process.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-f733508c",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "285048067924611644664548215597881830367",
"length": 1172.0
},
"target": {
"function": "main",
"file": "tests/unit/c/tmux_test.c"
},
"source": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd",
"signature_version": "v1",
"id": "CVE-2026-47271-fe298972",
"deprecated": false
}
]
vanir_signatures_modified
"2026-08-12T16:25:23Z"