CVE-2026-44710: pam_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login denial-of-service
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisksdrivegetserial(), udisksdrivegetvendor(), and udisksdrivegetmodel() directly to strcmp() without NULL checks. The GIO/UDisks API documentation states these accessors can return NULL for devices that do not expose the corresponding field. Passing NULL to strcmp() is undefined behaviour (typically a SIGSEGV). This vulnerability is fixed in 0.8.7.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44710?
The severity of CVE-2026-44710 is rated as medium with a score of 4.6.
How can I fix CVE-2026-44710?
To fix CVE-2026-44710, upgrade pam_usb to version 0.8.7 or later where the vulnerability has been addressed.
What does CVE-2026-44710 affect?
CVE-2026-44710 affects the pam_usb package which provides hardware authentication for Linux using removable media.
What can be impacted by CVE-2026-44710?
CVE-2026-44710 can lead to a denial-of-service condition due to a crash in the PAM module during authentication.
What is the cause of CVE-2026-44710?
CVE-2026-44710 is caused by a NULL pointer dereference in the pam_usb module when interacting with UDisks device fields.