PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47271 mcdope CVE debrief

pam_usb 0.9.0 fixes a local denial-of-service vulnerability where out-of-memory guards in xmalloc(), xrealloc(), and xstrdup() were implemented using assert(), which is compiled out when NDEBUG is defined. In release builds (common in Debian, Fedora, and Arch packages), allocation failures cause NULL pointer dereferences, crashing the PAM module and blocking authentication via sudo or login. An attacker with ability to induce memory pressure can exploit this to lock out all users.

Vendor
mcdope
Product
pam_usb
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-28
Advisory published
2026-05-27
Advisory updated
2026-05-28

Who should care

Linux system administrators using pam_usb for hardware-based authentication; security teams managing PAM configurations; distribution maintainers packaging pam_usb

Technical summary

The pam_usb library provides hardware authentication for Linux using removable media. Versions prior to 0.9.0 implemented memory allocation failure guards in src/mem.c using assert(data != NULL) for xmalloc(), xrealloc(), and xstrdup(). The C standard specifies that assert() expressions are compiled out when NDEBUG is defined, which is standard practice in release builds across major Linux distributions (Debian, Fedora, Arch). When these guards are removed, allocation failures return NULL, which callers dereference without checking—causing NULL pointer dereferences and PAM module crashes. Since PAM modules are loaded by sudo, login, and other authentication services, a crash results in authentication failure for the duration of the crash, creating a local denial-of-service condition. An attacker who can induce memory pressure during authentication can trigger this condition to lock all users out of sudo and login. The fix in 0.9.0 replaces assert()-based guards with proper runtime checks that abort on allocation failure regardless of build configuration.

Defensive priority

medium

Recommended defensive actions

  • Upgrade pam_usb to version 0.9.0 or later
  • Verify distribution packages are built with the fix
  • Monitor for PAM module crashes in authentication logs
  • Consider memory pressure monitoring on critical authentication systems

Evidence notes

CVSS 5.1 (MEDIUM). CWE-476 (NULL Pointer Dereference). Fixed in commit d003e551b794a9e3774ff4720830fb7aadaa48bd.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47271 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47271

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47271 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47271

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.