CVE-2026-64668: pam_usb: deny_remote bypassed by zone-indexed IPv6 addresses (fe80::1%eth0) in pusb_tmux_has_remote_clients

pamusb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the denyremote feature in pamusb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusbtmuxhasremoteclients() (src/tmux.c), the IPv6 detection pattern matched the address group and then immediately expected whitespace. On Linux systems with multi-homed network interfaces, w -i appends a zone index (scope identifier) to link-local IPv6 addresses — e.g. fe80::1%eth0. The %eth0 suffix appeared between the address and the next whitespace field, causing the regex match to fail even for an otherwise-matching remote session. The function returned "no remote clients" and granted access. This issue has been patched in version 0.9.3.