The vulnerability in pam_usb (before version 0.8.7) involves improper neutralization of special elements in the $TMUX environment variable. Specifically, the code in src/tmux.c reads $TMUX, splits it on commas, and interpolates the socket-path component directly into a shell command passed to popen(). Because the value is enclosed in double quotes without sanitization, an attacker can terminate the quoted string and inject arbitrary shell syntax. Since popen() runs as root within the PAM authentication stack, this leads to a high-severity OS command injection vulnerability. The vulnerability is addressed by sanitizing input or changing the handling of $TMUX in version 0.8.7.

Successful exploitation allows a local attacker with limited privileges to execute arbitrary commands as root during the PAM authentication process. This can lead to full system compromise, including confidentiality, integrity, and availability impacts. The CVSS score of 8.8 reflects the high impact on confidentiality, integrity, and availability with low attack complexity but requiring local privileges.

Upgrade pam_usb to version 0.8.7 or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, users should verify the version in use and update accordingly. Until upgraded, restrict access to environments where $TMUX can be manipulated by untrusted users. Patch status is not explicitly confirmed by a vendor advisory, so check for official updates or vendor communications for the latest remediation guidance.