CVE-2026-48792

The record

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/evdev.c silently ignores EACCES errors when opening /dev/input/event* nodes, causing pusb_has_virtual_input_device() to return 0 (no virtual devices found) even when every open() call failed due to insufficient permissions. The caller in src/local.c cannot distinguish a clean absence of virtual devices from a permission-denied scan, and acts on the false negative by continuing authentication without denying. This vulnerability is fixed in 0.9.1.

Affected packages

Related vulnerabilities

• CVE-2026-76642 util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status… CWE-390
• CVE-2026-59845 A flaw was found in libssh. CWE-390
• CVE-2026-44310 Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC… CWE-390
• CVE-2025-0029 Improper handling of error condition during host-induced faults can allow a local… CWE-390
• CVE-2024-12086 A flaw was found in rsync. CWE-390
• CVE-2024-11942 Drupal core vulnerable to improper error handling CWE-390
• CVE-2024-30255 Envoy is a cloud-native, open source edge and service proxy. CWE-390
• CVE-2026-113730 OGNL is an Object Graph Navigation Library for Java. CWE-693