CVE-2026-48980: pam_usb: getenv() used in PAM context allows environment variable injection into local-check logic
pamusb provides hardware authentication for Linux using removable media. In versions prior to 0.9.2, getenv() environment variables XRDPSESSION, DISPLAY and TMUX allow environment variable injection into local-check logic. These environment variables influence whether a current session is local or remote, and a PAM module that runs in the context of setuid binaries (sudo, su), getenv() returns attacker-controlled values whenever the process environment has been manipulated by a local user. This issue has been fixed in version 0.9.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pam_usbto a version that resolves this vulnerability.Fixed in 0.9.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48980?
The severity of CVE-2026-48980 is medium with a CVSS score of 6.3.
How do I fix CVE-2026-48980?
To fix CVE-2026-48980, upgrade to pam_usb version 0.9.2 or later.
What components are affected by CVE-2026-48980?
CVE-2026-48980 affects pam_usb versions prior to 0.9.2.
What does CVE-2026-48980 exploit?
CVE-2026-48980 exploits the use of getenv() in PAM context, allowing environment variable injection.
What are the implications of CVE-2026-48980 on system security?
CVE-2026-48980 can lead to unauthorized access to local sessions due to environment variable manipulation.