CVE-2026-44710 pam_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login denial-of-service
A NULL pointer dereference in pam_usb causes a crash when handling removable media, leading to a denial-of-service condition for system logins.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44710?
CVE-2026-44710 is a medium-severity vulnerability in mcdope pam_usb, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model() directly to strcmp() without NULL checks. The GIO/UDisks API documentation states these accessors can return NULL for devices that do not expose the corresponding field. Passing NULL to strcmp() is undefined behaviour (typically a SIGSEGV). This vulnerability is fixed in 0.8.7.
Weakness: CWE-476
Which versions are affected by CVE-2026-44710?
How do I fix CVE-2026-44710?
No fix has been published for CVE-2026-44710 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-44710 being exploited?
There is no known exploitation of CVE-2026-44710 in the wild and no public exploit code.
Sources
Also known as GHSA-j8cq-2gv6-gfwf.