CVE-2026-48986

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48986
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48986.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48986
Aliases
  • GHSA-h28h-9hc3-v595
Published
2026-06-18T17:20:51.643Z
Modified
2026-07-08T08:12:35.089020930Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
pam_usb: Infinite loop DoS in process-tree walk when parent process exits during authentication
Details

pamusb provides hardware authentication for Linux using removable media. In pamusb 0.9.1 and earlier, usbgetprocessparentid() can cause an infinite loop DoS because it does not initialize *ppid on failure. In pusblocallogin(), the same variable is reused as input and output in a process-tree while loop; if /proc/<pid>/stat cannot be read (for example, when an ancestor process exits during authentication), the PID is not updated and the loop does not terminate. This hangs the authenticating process (such as sudo, sshd, or login) until it is forcibly terminated. This issue has been fixed in version 0.9.2.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48986.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-835"
    ]
}
References

Affected packages

Git / github.com/mcdope/pam_usb

Affected ranges

Type
GIT
Repo
https://github.com/mcdope/pam_usb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d4083e266b7e18e41e58b3392b5856941a3b5b1c
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.9.2"
        }
    ]
}

Affected versions

0.*
0.5.0
0.7.1
0.7.2
0.7.3
0.8.3
0.8.4
0.8.7
0.9.0
0.9.1
v0.*
v0.7.0
v0.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48986.json"