{"id":"CVE-2026-47270","summary":"pam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote result","details":"pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb is a PAM module loaded into the host process (sudo, login, GDM, GNOME Shell). Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the deny_remote feature called the non-reentrant strtok(), which stores state in a single global pointer. If two authentications race, one thread's strtok() call can overwrite the other's in-progress tokenisation pointer, causing incorrect parsing of the tmux session data or the /proc environ scan that backs the remote-session detection logic. Additionally, pusb_tmux_get_client_tty() passed the raw pointer returned by getenv(TMUX) directly to strtok(). getenv() returns a pointer into the live process environment block; strtok() inserts NUL bytes into that block, permanently corrupting the TMUX variable for subsequent code running in the same process. In long-lived display managers this affects all future authentications in that process. The combined effect can cause deny_remote=true to return an incorrect decision for a remote session, or an incorrect decision for a local session, depending on thread interleaving. This vulnerability is fixed in 0.9.0.","aliases":["GHSA-j3xw-vc43-x7jg"],"modified":"2026-07-22T00:04:11.957315Z","published":"2026-05-27T20:10:37.108Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-362"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47270.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47270.json"},{"type":"ADVISORY","url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-j3xw-vc43-x7jg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47270"},{"type":"FIX","url":"https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51"},{"type":"FIX","url":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mcdope/pam_usb","events":[{"introduced":"0"},{"fixed":"94f1640a61d49dfaf38e782680a52f01d5bf8b51"},{"fixed":"d003e551b794a9e3774ff4720830fb7aadaa48bd"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.9.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47270.json","vanir_signatures_modified":"2026-07-22T00:04:11Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["262911015990322610702261089155261249682","5266001408631339088761356107814227983","291349440928906439699371008382326232311","225096573628138229947618687053623765928","262578963839469867474635328202858259656","311712118371910535799835830521274556888","7379981111785203850979097694115606253","112892583337373005659928768866861990416","249739417969245992654643752823721289652","157755383342522050090306436053927844186","177093855106373658117775109180341948895","192666591260830817986478220132790010265","216578758083005068791126096364021710730","336987300098518302550111016658372169877","101069065376998439565468922105033208124","286771843561252693377998359571269102801","163695927965898342024249099361292943945","285949206004630724530471896398341150112","287273177978117498079018578162762118363","166516778117059356158618559805285084172","183508843659844739825072715948796063681","206368726984246892816477624709972316217","6109587750457056552849770597554481269","19496250595211965295999435584057022448","49847285256359794278916376495824307659","281863570764585495241308357858122455530","170208828891162154812528372610552496054","279379735731478962668002509252962486529","112152214440022389867754951954322884630","177460802482926588248769178317273325790","65258931473368097914871043960095430273","187696419268926468345466960682922156445","68575082185330477995091765389589651169","183682804171076640625010812448521690496","335106596199974288256242371191420267461","275926368653739390620423436200624622828","218286113397337799703126256186044663387","337760362337746022005964915234376720560","164321562254855354759736624186201526907","51064445421604946937433164556113474154","290585921949763765262018930552698757702","114953744071630133535866603028919343327","230643492342550391116044953351131883734","27671880819215563947492383921065479247","91739694373327120425202651805904071218","247117775867240821435708797971878398957","35159466061848887496965386376049141252","288103764160444775684599972474944878986","40050758366600950278498653531163955347","148776272078089211531841737178032672790","280023093754470373868261624931988084299","266456732266638609151505188293053155290","128668682274606412648903077518059573198","237490922104409067314785161878673905843","324676600675885778586373217150812568285","193078671918961018790561220794490247008","21568872757727452550738615936181255089","109649874748748727435644786329122003446","324774207079177244358917404630644437778"],"threshold":0.9},"id":"CVE-2026-47270-046097da","signature_type":"Line","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/tmux.c"}},{"signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"tests/unit/c/process_test.c"},"deprecated":false,"digest":{"line_hashes":["197458212444380363295428787952517314852","208137722568255458053890653271638898988","96249688255229574990695498906277129507","58009843163394029378340693699999721745","315248826870388833338456291117440162116","163745894376564430582041935690794676227","86145721126598957970403503943064853810"],"threshold":0.9},"id":"CVE-2026-47270-0e04c7ce","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"118540602697610104929992365223003157868","length":884},"id":"CVE-2026-47270-32acab7c","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"function":"pusb_is_loginctl_local","file":"src/local.c"}},{"deprecated":false,"digest":{"function_hash":"203600649413043455361259512633942592934","length":2058},"id":"CVE-2026-47270-4301ba9a","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/tmux.c","function":"pusb_tmux_get_client_tty"}},{"source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/device.c"},"deprecated":false,"digest":{"line_hashes":["278902535416286447839924323833110399795","155960015283809876256569423692780497469","237186881707854572189504021530801782522","324700451312078704143184272489979717709","2203622478053677454702293863439406127","293138842475019692111680913641234356407","239623305770701901212045270447896656190","160447442901675626721800280640016890792","49777132974118063815685655147469448088"],"threshold":0.9},"id":"CVE-2026-47270-518d2dc3","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["147934107663606388051006008125952921126","92337529215530401553032780474864361394","44707840582841626741769719373809258129","306461306008319159495108460418593378389","169912879667732806491207472292876005467","182567202058999392240928796821204878721","182320077821759376365141273982877851617","298847941396691813126217917940169498402","66753971756900225045462776813821731636","152124220399182528725536825348353698508","212886880883270955472712518291380203693","35333448975581889925330522044894250858","168389655503624393025663654987294695421","193695462715558860524164204422766006860","204645581565996732624785769335368179902","161273255475203899743091087373458844282"],"threshold":0.9},"id":"CVE-2026-47270-52a28c32","signature_type":"Line","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/local.c"}},{"digest":{"function_hash":"63512548676523806955687189769095979786","length":3119},"id":"CVE-2026-47270-6934f5f8","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/pad.c","function":"pusb_pad_update"},"deprecated":false},{"deprecated":false,"digest":{"length":867,"function_hash":"53001927620320481193486326141190240804"},"id":"CVE-2026-47270-69c6ffc2","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/local.c","function":"pusb_is_tty_local"}},{"signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/process.c"},"deprecated":false,"digest":{"line_hashes":["37852091618285221852330457908219665427","229929867358431245951844013405192999723","139274644599127365813573838886725190632","261217959750407315900978100219828723970","90436370490808044441896508279341347416","256946047910976823222698117872995207111","135724283148473709760848591736763767981","72354123135146967683427777072920094160","52783421829893770835852271021436454805","279318470609240378651878974597517541571","192294339745684637749809913669832386122","14703187207152817555848996366957102190"],"threshold":0.9},"id":"CVE-2026-47270-735594b3","signature_type":"Line"},{"target":{"file":"src/pad.c"},"deprecated":false,"digest":{"line_hashes":["94903299979483815936981700935042760496","100311666774101747484908858465731122408","336533102673951163000546088809064524562","88477740023413976462308541912778193833","17062292484768571178449548993950666756","152321812389447110531910390168578424998","182879399887190052788011996914165077003","232838246175202634809163413973300233811","87766368119499752042584661591121604667","75155788891650128956810404311642681607","210479684777317256413100721194467395375","209767839312200780141492242634499408418","17291579197998356607189659803492620856","72791364970238907284709093667903771536","224291528485295405291870900335496438800","168158448865850392446694776052270007871","207208252093947032464690614405967485679","338759544048713327444817565478461680236","87502584103955288744030655986439995310","291997586007469813865494788274821506072","303058120691191719290591507491580054753","270755086200780821924791656032268740507","155965411607868335577653248627884621775","232766157788758291574734060316795294166","184960450536297230053600601640610210300"],"threshold":0.9},"id":"CVE-2026-47270-74dcd252","signature_type":"Line","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd"},{"signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/device.c","function":"pusb_device_connected"},"deprecated":false,"digest":{"function_hash":"219666381063073677475353283537575248100","length":2216},"id":"CVE-2026-47270-807f3639","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"108693028144790148875812204470552216634","length":926},"id":"CVE-2026-47270-813901ce","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/local.c","function":"pusb_get_tty_by_loginctl"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51","target":{"file":"tests/unit/c/pad_test.c"},"deprecated":false,"digest":{"line_hashes":["103043566955760231311265397091135496595","41210646900460086679233014620339679688","95363177011039510507650388920785764417","332421449890385902882317846752794141746","13389970975463208967150958338674760090","94830844597113089334161359174017474885","30931317114101636730826147037243696785"],"threshold":0.9},"id":"CVE-2026-47270-84abbc09"},{"deprecated":false,"digest":{"function_hash":"141700857347142188511384482832760219899","length":161},"id":"CVE-2026-47270-869f2770","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/mem.c","function":"xrealloc"}},{"target":{"file":"tests/unit/c/process_test.c","function":"main"},"deprecated":false,"digest":{"function_hash":"98111767787322465915364467208934293295","length":731},"id":"CVE-2026-47270-9c77c14b","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd"},{"deprecated":false,"digest":{"function_hash":"8179206408387355548549305931699477801","length":708},"id":"CVE-2026-47270-9ff84d0d","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51","target":{"file":"tests/unit/c/pad_test.c","function":"main"}},{"source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/mem.c"},"deprecated":false,"digest":{"line_hashes":["311482001624001483380926476158430264275","46066139881279367702595913081945114239","95495177443689330961560508545687142326","146107011773348669792776997142552107150","256863636340554980631050045578996607405","16846325328480568452821454256812006424","31937643072928917594498453896700783769","53430278062263847868268972235147502862","107925962242929147665209654584403381129","257987689222714781086777781387135920703","138022992293149923614431035114877080298","150328458956740517311228598412547178758","257548387611727911777533043283299226765","219943424528155585785360705812332463092","280111740837792367915351475600947684271"],"threshold":0.9},"id":"CVE-2026-47270-acf03f64","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-47270-c76222e2","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/mem.c","function":"xstrdup"},"deprecated":false,"digest":{"function_hash":"299886335175012807100282676890286341151","length":144}},{"source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/local.c","function":"pusb_get_tty_from_display_server"},"deprecated":false,"digest":{"function_hash":"69657029001219523897740521195009473994","length":2279},"id":"CVE-2026-47270-cadccfd6","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["232063608063545694251461812487647294996","135399071238016763047535409142022088406","96249688255229574990695498906277129507","272524994958922618277235637913735398983","190314764333791239212371207457555990678","167730370991931416403533887945494627685","216824450044806261731370335210800381443"],"threshold":0.9},"id":"CVE-2026-47270-cd28597c","signature_type":"Line","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"tests/unit/c/tmux_test.c"}},{"source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"function":"xmalloc","file":"src/mem.c"},"deprecated":false,"digest":{"function_hash":"192607803440488861342048580638874554237","length":136},"id":"CVE-2026-47270-d676ab81","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/pad.c","function":"pusb_pad_should_update"},"deprecated":false,"digest":{"function_hash":"232135772049704262345430493436889995749","length":806},"id":"CVE-2026-47270-ec2c05f4","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/process.c","function":"pusb_get_process_envvar"},"deprecated":false,"digest":{"function_hash":"38834797829152044862613013635930741978","length":712},"id":"CVE-2026-47270-f733508c"},{"digest":{"function_hash":"285048067924611644664548215597881830367","length":1172},"id":"CVE-2026-47270-fe298972","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"tests/unit/c/tmux_test.c","function":"main"},"deprecated":false}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}