Vulnerability · Published Jun 18, 2026 · Assigned by GitHub_M

CVE-2026-48986pam_usb: Infinite loop DoS in process-tree walk when parent process exits during authentication

Medium 4.7

In plain English

A medium-severity infinite loop in pam_usb from mcdope. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.1%top 96.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 and earlier, usb_get_process_parent_id() can cause an infinite loop DoS because it does not initialize *ppid on failure. In pusb_local_login(), the same variable is reused as input and output in a process-tree while loop; if /proc/<pid>/stat cannot be read (for example, when an ancestor process exits during authentication), the PID is not updated and the loop does not terminate. This hangs the authenticating process (such as sudo, sshd, or login) until it is forcibly terminated. This issue has been fixed in version 0.9.2.

Affected products (as reported)

Vendor	Product	Versions
mcdope	pam_usb	< 0.9.2

Weakness: CWE-835 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/mcdope/pam_usb/security/advisories/GHSA-h28h-9hc3-v595 x_refsource_CONFIRM
https://github.com/mcdope/pam_usb/releases/tag/0.9.2 x_refsource_MISC