← CVE Intelligence

CVE-2026-44710

pam_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login denial-of-service PUBLISHED

Description (CNA)

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model() directly to strcmp() without NULL checks. The GIO/UDisks API documentation states these accessors can return NULL for devices that do not expose the corresponding field. Passing NULL to strcmp() is undefined behaviour (typically a SIGSEGV). This vulnerability is fixed in 0.8.7.

Affected (CNA)

Vendor / productVersions
mcdope / pam_usbaffected < 0.8.7

CWE

CWE-476

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.