The pam_usb module for Linux hardware authentication improperly handles EACCES errors when opening /dev/input/event* device nodes in versions before 0.9.1. Specifically, the function pusb_has_virtual_input_device() returns 0 indicating no virtual devices found even if all open() calls failed due to insufficient permissions. Consequently, the caller cannot differentiate between a genuine absence of virtual devices and a permission-denied scenario, leading to authentication proceeding without denial. This is classified under CWE-390 (Detection of Error Condition Without Action) and CWE-693 (Protection Mechanism Failure). The vulnerability has a CVSS 3.1 score of 4.4 (medium severity) and is resolved in pam_usb version 0.9.1.

The vulnerability may allow an attacker with limited privileges to bypass hardware authentication checks by exploiting the silent failure to detect permission errors on input device nodes. This could lead to unauthorized authentication continuation when it should be denied, potentially weakening system security. There are no known exploits in the wild at this time.

Upgrade pam_usb to version 0.9.1 or later, where this vulnerability is fixed. Since the vendor advisory does not provide additional remediation details or temporary fixes, applying the official patch version is the recommended action. Patch status is not explicitly confirmed beyond the fix in version 0.9.1; verify with vendor sources for the latest guidance.