CVE-2026-44711: pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption
Published May 27, 2026
·Updated
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authentication bypass and root file corruption. This vulnerability is fixed in 0.8.7.
Affected Software
1 affected component
pam_usb pam_usb<0.8.7
Event History
May 27, 2026
CVE Published
via MITRE·08:18 PM
Data Sourced
via MITRE·08:18 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-44711?
The severity of CVE-2026-44711 is high with a score of 7.9.
2
How do I fix CVE-2026-44711?
To fix CVE-2026-44711, upgrade to pam_usb version 0.8.7 or later.
3
What kind of attacks are associated with CVE-2026-44711?
CVE-2026-44711 is associated with symlink attacks that enable authentication bypass and root file corruption.
4
What versions of pam_usb are affected by CVE-2026-44711?
Versions of pam_usb prior to 0.8.7 are affected by CVE-2026-44711.
5
What does pam_usb provide in terms of authentication?
pam_usb provides hardware authentication for Linux using ordinary removable media.