PatchSiren cyber security CVE debrief
CVE-2026-48792 mcdope CVE debrief
pam_usb 0.9.0 and earlier fails to propagate EACCES errors when scanning /dev/input/event* nodes in src/evdev.c. The function pusb_has_virtual_input_device() returns 0 (no virtual devices detected) when open() calls fail due to insufficient permissions, rather than signaling an error condition. The caller in src/local.c interprets this false negative as a clean scan result and continues authentication flow without denying access. This allows local attackers with restricted permissions to bypass virtual input device detection, potentially circumventing hardware-based authentication requirements. The vulnerability stems from CWE-390 (Detection of Error Condition Without Action) and CWE-693 (Protection Mechanism Failure). Fixed in pam_usb 0.9.1.
- Vendor
- mcdope
- Product
- pam_usb
- CVSS
- MEDIUM 4.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-27
- Original CVE updated
- 2026-05-28
- Advisory published
- 2026-05-27
- Advisory updated
- 2026-05-28
Who should care
Linux system administrators using pam_usb for hardware-based authentication; security teams evaluating PAM module implementations; developers of authentication systems handling hardware device enumeration
Technical summary
The vulnerability exists in src/evdev.c where open() calls on /dev/input/event* nodes return -1 with errno=EACCES when the process lacks read permissions. The code silently continues the loop without propagating the error, accumulating zero successful opens. The function returns 0 (boolean false for 'no virtual devices'), which src/local.c interprets as successful completion rather than scan failure. This breaks the security invariant that virtual input device presence should be verifiable; when verification fails due to permissions, authentication should deny or fallback safely, not proceed. The fix in 0.9.1 presumably adds explicit error handling to distinguish permission failures from absence of devices.
Defensive priority
medium
Recommended defensive actions
- Upgrade pam_usb to version 0.9.1 or later to obtain the corrected error handling in src/evdev.c
- Review local PAM configuration to ensure pam_usb is properly integrated with fallback authentication mechanisms
- Audit system logs for authentication anomalies that may indicate bypass attempts
- Verify that /dev/input/event* device nodes have appropriate permissions for the authentication process
- Consider implementing additional monitoring for failed device access attempts in authentication paths
Evidence notes
NVD entry published 2026-05-27 with CVSS 4.4 (MEDIUM). GitHub Security Advisory GHSA-pvrg-chgw-x42c confirms fix in 0.9.1. Related issues #351 and #55 document the permission handling defect in evdev.c.
Official resources
2026-05-27