PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47272 mcdope CVE debrief

pam_usb 0.9.0 fixes an authentication bypass in the pusb_pad_compare() function. Prior to this version, the function verified that the user-side pad file (~/.pamusb/device.pad) was readable but did not enforce that the system-side pad on the USB device was present and readable. If a local user deleted their own ~/.pamusb/device.pad, the resulting failure was treated as non-fatal in certain code paths, allowing authentication to succeed without the physical USB device being verified. This permits local privilege escalation by removing the hardware authentication requirement.

Vendor
mcdope
Product
pam_usb
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-28
Advisory published
2026-05-27
Advisory updated
2026-05-28

Who should care

Organizations using pam_usb for hardware-based Linux authentication, system administrators managing multi-factor authentication deployments, and security teams responsible for privilege escalation prevention on Linux endpoints.

Technical summary

The pusb_pad_compare() function in pam_usb's src/pad.c prior to 0.9.0 fails to properly enforce dual verification of authentication pads. The function checks readability of the user-side pad (~/.pamusb/device.pad) but does not similarly verify the system-side pad on the USB device. When the user-side pad is deleted or unreadable, the error return is treated as non-fatal in certain authentication paths, resulting in successful authentication without possession of the registered USB device. A local attacker can exploit this by removing their own pad file to bypass hardware-based authentication requirements.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade pam_usb to version 0.9.0 or later to obtain the fix for pusb_pad_compare()
  • Audit systems for pam_usb installations and verify current version
  • Review authentication logs for anomalous successful authentications that may indicate exploitation
  • Ensure file permissions on ~/.pamusb/ directories restrict unauthorized modification
  • Consider implementing additional authentication factors as defense in depth

Evidence notes

The vulnerability exists in src/pad.c in the pusb_pad_compare() function. The fix in version 0.9.0 enforces proper verification of both pad files. CVSS 3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. CWE-287 (Improper Authentication) and CWE-908 (Use of Uninitialized Resource) are identified as relevant weaknesses.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47272 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47272

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47272 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47272

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.