CVE-2026-48066: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in mcdope pam_usb
CVE-2026-48066 is a race condition vulnerability in pam_usb versions prior to 0.9.1. The issue arises from a process-wide static pointer in src/log.c that is overwritten on every PAM invocation with the address of a stack-local variable, violating PAM's re-entrancy requirements. This creates a data race when multiple threads invoke the PAM stack concurrently. The vulnerability has a medium severity with a CVSS score of 5.7 and is fixed in version 0.9.1.
AI Analysis
Technical Summary
pam_usb, a hardware authentication module for Linux using removable media, contains a race condition vulnerability (CWE-362) in versions before 0.9.1. The vulnerability is due to a process-wide static pointer in src/log.c that is assigned the address of a stack-local variable on each PAM invocation, violating the re-entrancy requirement of PAM. Concurrent invocations from multiple threads can cause data races, potentially leading to improper synchronization and undefined behavior. This issue was resolved in version 0.9.1.
Potential Impact
The vulnerability can cause data races and improper synchronization during concurrent PAM invocations, potentially leading to denial of service or instability in the authentication process. The CVSS vector indicates local attack complexity is high, no privileges required, no user interaction, and the impact is limited to integrity and availability (no confidentiality impact). There are no known exploits in the wild.
Mitigation Recommendations
Upgrade pam_usb to version 0.9.1 or later, where this race condition vulnerability is fixed. No other official remediation or temporary fixes are documented. Patch status is confirmed by the vendor's versioning information.
CVE-2026-48066: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in mcdope pam_usb
Description
CVE-2026-48066 is a race condition vulnerability in pam_usb versions prior to 0.9.1. The issue arises from a process-wide static pointer in src/log.c that is overwritten on every PAM invocation with the address of a stack-local variable, violating PAM's re-entrancy requirements. This creates a data race when multiple threads invoke the PAM stack concurrently. The vulnerability has a medium severity with a CVSS score of 5.7 and is fixed in version 0.9.1.
CVSS v3.1
Score 5.7medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
pam_usb, a hardware authentication module for Linux using removable media, contains a race condition vulnerability (CWE-362) in versions before 0.9.1. The vulnerability is due to a process-wide static pointer in src/log.c that is assigned the address of a stack-local variable on each PAM invocation, violating the re-entrancy requirement of PAM. Concurrent invocations from multiple threads can cause data races, potentially leading to improper synchronization and undefined behavior. This issue was resolved in version 0.9.1.
Potential Impact
The vulnerability can cause data races and improper synchronization during concurrent PAM invocations, potentially leading to denial of service or instability in the authentication process. The CVSS vector indicates local attack complexity is high, no privileges required, no user interaction, and the impact is limited to integrity and availability (no confidentiality impact). There are no known exploits in the wild.
Mitigation Recommendations
Upgrade pam_usb to version 0.9.1 or later, where this race condition vulnerability is fixed. No other official remediation or temporary fixes are documented. Patch status is confirmed by the vendor's versioning information.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-20T18:25:25.707Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a17519de29bf47b50e771bc
Added to database: 05/27/2026, 20:18:37 UTC
Last enriched: 06/03/2026, 20:53:33 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.