CVE-2026-44713: pam_usb: Command injection via $TMUX environment variable leads to RCE as root
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, splits it on commas, and interpolates the socket-path component directly into a shell command passed to popen(). Because the value is placed inside double-quotes without sanitisation, any value containing " terminates the quoted string and injects arbitrary shell syntax. popen() runs as root inside the PAM stack. This vulnerability is fixed in 0.8.7.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44713?
The severity of CVE-2026-44713 is rated as high with a score of 8.8.
How do I fix CVE-2026-44713?
To fix CVE-2026-44713, upgrade to pam_usb version 0.8.7 or later where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-44713?
CVE-2026-44713 is an OS command injection vulnerability that can lead to remote code execution as root.
Who is affected by CVE-2026-44713?
Users of pam_usb versions prior to 0.8.7 are affected by CVE-2026-44713 due to improper handling of the $TMUX environment variable.
What can an attacker do with CVE-2026-44713?
An attacker can exploit CVE-2026-44713 to execute arbitrary commands as root through the command injection vulnerability.