The pam_usb module for Linux hardware authentication, before version 0.9.1, fails to properly handle EACCES errors when opening /dev/input/event* devices in src/evdev.c. This causes the function pusb_has_virtual_input_device() to incorrectly report no virtual input devices found, even if the failure was due to permission denial rather than absence of devices. Consequently, the caller in src/local.c cannot differentiate between a legitimate absence of devices and a permission error, leading to authentication proceeding without denial in error cases. This vulnerability is addressed in pam_usb version 0.9.1.

This vulnerability can lead to a scenario where authentication bypass occurs because the system incorrectly assumes no virtual input devices are present due to silent permission errors. The impact is limited to local attackers with limited privileges (PR:L) and results in low confidentiality and integrity impacts without availability impact. The CVSS score is 4.4 (medium severity). There are no known exploits in the wild.

Upgrade pam_usb to version 0.9.1 or later, where this issue is fixed. Since no official patch link or vendor advisory is provided, verify the upgrade from trusted sources. Patch status is not yet confirmed via vendor advisory; check vendor communications for the latest remediation guidance.