Skip to content
OpenAdvisories
High · 7.9 CVE-2026-44711 EUVD-2026-32659

pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption

Published May 27, 2026 · Updated May 28, 2026 · Assigned by GitHub_M

Description

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authentication bypass and root file corruption. This vulnerability is fixed in 0.8.7.

Affected products

VendorProductAffectedFixed
mcdope pam_usb < 0.8.7 —

References