{"id":"CVE-2026-47270","summary":"pam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote result","details":"pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb is a PAM module loaded into the host process (sudo, login, GDM, GNOME Shell). Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the deny_remote feature called the non-reentrant strtok(), which stores state in a single global pointer. If two authentications race, one thread's strtok() call can overwrite the other's in-progress tokenisation pointer, causing incorrect parsing of the tmux session data or the /proc environ scan that backs the remote-session detection logic. Additionally, pusb_tmux_get_client_tty() passed the raw pointer returned by getenv(TMUX) directly to strtok(). getenv() returns a pointer into the live process environment block; strtok() inserts NUL bytes into that block, permanently corrupting the TMUX variable for subsequent code running in the same process. In long-lived display managers this affects all future authentications in that process. The combined effect can cause deny_remote=true to return an incorrect decision for a remote session, or an incorrect decision for a local session, depending on thread interleaving. This vulnerability is fixed in 0.9.0.","aliases":["GHSA-j3xw-vc43-x7jg"],"modified":"2026-08-12T16:25:22.508694Z","published":"2026-05-27T20:10:37.108Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-362"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47270.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47270.json"},{"type":"ADVISORY","url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-j3xw-vc43-x7jg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47270"},{"type":"FIX","url":"https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51"},{"type":"FIX","url":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mcdope/pam_usb","events":[{"introduced":"0"},{"fixed":"94f1640a61d49dfaf38e782680a52f01d5bf8b51"},{"fixed":"d003e551b794a9e3774ff4720830fb7aadaa48bd"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.9.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47270.json","vanir_signatures_modified":"2026-08-12T16:25:22Z","vanir_signatures":[{"id":"CVE-2026-47270-046097da","signature_type":"Line","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/tmux.c"},"deprecated":false,"digest":{"line_hashes":["262911015990322610702261089155261249682","5266001408631339088761356107814227983","291349440928906439699371008382326232311","225096573628138229947618687053623765928","262578963839469867474635328202858259656","311712118371910535799835830521274556888","7379981111785203850979097694115606253","112892583337373005659928768866861990416","249739417969245992654643752823721289652","157755383342522050090306436053927844186","177093855106373658117775109180341948895","192666591260830817986478220132790010265","216578758083005068791126096364021710730","336987300098518302550111016658372169877","101069065376998439565468922105033208124","286771843561252693377998359571269102801","163695927965898342024249099361292943945","285949206004630724530471896398341150112","287273177978117498079018578162762118363","166516778117059356158618559805285084172","183508843659844739825072715948796063681","206368726984246892816477624709972316217","6109587750457056552849770597554481269","19496250595211965295999435584057022448","49847285256359794278916376495824307659","281863570764585495241308357858122455530","170208828891162154812528372610552496054","279379735731478962668002509252962486529","112152214440022389867754951954322884630","177460802482926588248769178317273325790","65258931473368097914871043960095430273","187696419268926468345466960682922156445","68575082185330477995091765389589651169","183682804171076640625010812448521690496","335106596199974288256242371191420267461","275926368653739390620423436200624622828","218286113397337799703126256186044663387","337760362337746022005964915234376720560","164321562254855354759736624186201526907","51064445421604946937433164556113474154","290585921949763765262018930552698757702","114953744071630133535866603028919343327","230643492342550391116044953351131883734","27671880819215563947492383921065479247","91739694373327120425202651805904071218","247117775867240821435708797971878398957","35159466061848887496965386376049141252","288103764160444775684599972474944878986","40050758366600950278498653531163955347","148776272078089211531841737178032672790","280023093754470373868261624931988084299","266456732266638609151505188293053155290","128668682274606412648903077518059573198","237490922104409067314785161878673905843","324676600675885778586373217150812568285","193078671918961018790561220794490247008","21568872757727452550738615936181255089","109649874748748727435644786329122003446","324774207079177244358917404630644437778"],"threshold":0.9}},{"source":"https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51","target":{"file":"src/pad.c"},"deprecated":false,"digest":{"line_hashes":["322473209862143193938858576334977948437","10220667717051191786692243768002431884","73949692854927336572545724243173516925","49238870829966699232958856409432232894","12295089666784290378532797236734877349","119503566691455413298585228443682540069","107701813272400857039964317345999074063","240393103929164154188051522405318318365","94532230044856156884910365099564222270","197903290560577501172208334331672645461","296147406666199251511496796648707179176","36354252086532116141580889543064923693","59832461958819368602929235604976899068","175294918481048923063448411646272386124","290838763574324052848211854813344214426","181127464265911351825545219126805491390","68373907683464940620026403721828043993","117320503381255650501297958159919332778","210701948702695536308536904934538228999","264267830376009118265573882055029993843","5968029983627068157012583853631295077","75060045776255224519070908138465146155","75853711001285302594451286944931478138","134446416772801087182365680826851001575","107701813272400857039964317345999074063","131960049600835269002736859892896866131","256247060336202766357756194962312591594","233050692830113504749485000086177935912","28212915200286928549700085575526438300","216988578282613007007985261430031626356","155363270761711570277276699574607161952","81597634653724379243982125099675529800","33475054820084609932777693277888806432","296617127320272450520554245846785701309","173310137911901892974373333441277486799","248298805282246386983321471926948785687","33475054820084609932777693277888806432","296617127320272450520554245846785701309","173310137911901892974373333441277486799","185912229395687213953378584005342468258"],"threshold":0.9},"id":"CVE-2026-47270-09596129","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-47270-0e04c7ce","signature_type":"Line","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"tests/unit/c/process_test.c"},"deprecated":false,"digest":{"line_hashes":["197458212444380363295428787952517314852","208137722568255458053890653271638898988","96249688255229574990695498906277129507","58009843163394029378340693699999721745","315248826870388833338456291117440162116","163745894376564430582041935690794676227","86145721126598957970403503943064853810"],"threshold":0.9}},{"target":{"file":"src/local.c","function":"pusb_is_loginctl_local"},"deprecated":false,"digest":{"function_hash":"118540602697610104929992365223003157868","length":884},"id":"CVE-2026-47270-32acab7c","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd"},{"id":"CVE-2026-47270-4301ba9a","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/tmux.c","function":"pusb_tmux_get_client_tty"},"deprecated":false,"digest":{"length":2058,"function_hash":"203600649413043455361259512633942592934"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/device.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["278902535416286447839924323833110399795","155960015283809876256569423692780497469","237186881707854572189504021530801782522","324700451312078704143184272489979717709","2203622478053677454702293863439406127","293138842475019692111680913641234356407","239623305770701901212045270447896656190","160447442901675626721800280640016890792","49777132974118063815685655147469448088"]},"id":"CVE-2026-47270-518d2dc3"},{"target":{"file":"src/local.c"},"deprecated":false,"digest":{"line_hashes":["147934107663606388051006008125952921126","92337529215530401553032780474864361394","44707840582841626741769719373809258129","306461306008319159495108460418593378389","169912879667732806491207472292876005467","182567202058999392240928796821204878721","182320077821759376365141273982877851617","298847941396691813126217917940169498402","66753971756900225045462776813821731636","152124220399182528725536825348353698508","212886880883270955472712518291380203693","35333448975581889925330522044894250858","168389655503624393025663654987294695421","193695462715558860524164204422766006860","204645581565996732624785769335368179902","161273255475203899743091087373458844282"],"threshold":0.9},"id":"CVE-2026-47270-52a28c32","signature_type":"Line","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd"},{"source":"https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51","target":{"file":"src/pad.c","function":"pusb_pad_build_system_path"},"deprecated":false,"digest":{"function_hash":"104037110120929912248246636287442050846","length":1301},"id":"CVE-2026-47270-58078f68","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/pad.c","function":"pusb_pad_update"},"deprecated":false,"digest":{"function_hash":"63512548676523806955687189769095979786","length":3119},"id":"CVE-2026-47270-6934f5f8","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/local.c","function":"pusb_is_tty_local"},"deprecated":false,"digest":{"function_hash":"53001927620320481193486326141190240804","length":867},"id":"CVE-2026-47270-69c6ffc2","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/process.c"},"deprecated":false,"digest":{"line_hashes":["37852091618285221852330457908219665427","229929867358431245951844013405192999723","139274644599127365813573838886725190632","261217959750407315900978100219828723970","90436370490808044441896508279341347416","256946047910976823222698117872995207111","135724283148473709760848591736763767981","72354123135146967683427777072920094160","52783421829893770835852271021436454805","279318470609240378651878974597517541571","192294339745684637749809913669832386122","14703187207152817555848996366957102190"],"threshold":0.9},"id":"CVE-2026-47270-735594b3"},{"signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/pad.c"},"deprecated":false,"digest":{"line_hashes":["94903299979483815936981700935042760496","100311666774101747484908858465731122408","336533102673951163000546088809064524562","88477740023413976462308541912778193833","17062292484768571178449548993950666756","152321812389447110531910390168578424998","182879399887190052788011996914165077003","232838246175202634809163413973300233811","87766368119499752042584661591121604667","75155788891650128956810404311642681607","210479684777317256413100721194467395375","209767839312200780141492242634499408418","17291579197998356607189659803492620856","72791364970238907284709093667903771536","224291528485295405291870900335496438800","168158448865850392446694776052270007871","207208252093947032464690614405967485679","338759544048713327444817565478461680236","87502584103955288744030655986439995310","291997586007469813865494788274821506072","303058120691191719290591507491580054753","270755086200780821924791656032268740507","155965411607868335577653248627884621775","232766157788758291574734060316795294166","184960450536297230053600601640610210300"],"threshold":0.9},"id":"CVE-2026-47270-74dcd252","signature_type":"Line"},{"source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/device.c","function":"pusb_device_connected"},"deprecated":false,"digest":{"function_hash":"219666381063073677475353283537575248100","length":2216},"id":"CVE-2026-47270-807f3639","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/local.c","function":"pusb_get_tty_by_loginctl"},"deprecated":false,"digest":{"function_hash":"108693028144790148875812204470552216634","length":926},"id":"CVE-2026-47270-813901ce","signature_type":"Function","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["103043566955760231311265397091135496595","41210646900460086679233014620339679688","95363177011039510507650388920785764417","332421449890385902882317846752794141746","13389970975463208967150958338674760090","94830844597113089334161359174017474885","30931317114101636730826147037243696785"]},"id":"CVE-2026-47270-84abbc09","signature_type":"Line","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51","target":{"file":"tests/unit/c/pad_test.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"141700857347142188511384482832760219899","length":161},"id":"CVE-2026-47270-869f2770","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/mem.c","function":"xrealloc"}},{"signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51","target":{"file":"src/pad.c","function":"pusb_pad_build_device_path"},"deprecated":false,"digest":{"function_hash":"36497502091512782938587189377536074987","length":767},"id":"CVE-2026-47270-86cd74f9","signature_type":"Function"},{"target":{"file":"src/pad.c","function":"pusb_pad_open_device"},"deprecated":false,"digest":{"function_hash":"332238223767990387921320329539829554812","length":648},"id":"CVE-2026-47270-8ffb9f60","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51"},{"digest":{"function_hash":"98111767787322465915364467208934293295","length":731},"id":"CVE-2026-47270-9c77c14b","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"tests/unit/c/process_test.c","function":"main"},"deprecated":false},{"id":"CVE-2026-47270-9ff84d0d","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51","target":{"file":"tests/unit/c/pad_test.c","function":"main"},"deprecated":false,"digest":{"length":708,"function_hash":"8179206408387355548549305931699477801"}},{"source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/mem.c"},"deprecated":false,"digest":{"line_hashes":["311482001624001483380926476158430264275","46066139881279367702595913081945114239","95495177443689330961560508545687142326","146107011773348669792776997142552107150","256863636340554980631050045578996607405","16846325328480568452821454256812006424","31937643072928917594498453896700783769","53430278062263847868268972235147502862","107925962242929147665209654584403381129","257987689222714781086777781387135920703","138022992293149923614431035114877080298","150328458956740517311228598412547178758","257548387611727911777533043283299226765","219943424528155585785360705812332463092","280111740837792367915351475600947684271"],"threshold":0.9},"id":"CVE-2026-47270-acf03f64","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/mem.c","function":"xstrdup"},"deprecated":false,"digest":{"function_hash":"299886335175012807100282676890286341151","length":144},"id":"CVE-2026-47270-c76222e2","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/local.c","function":"pusb_get_tty_from_display_server"},"deprecated":false,"digest":{"function_hash":"69657029001219523897740521195009473994","length":2279},"id":"CVE-2026-47270-cadccfd6","signature_type":"Function"},{"target":{"file":"tests/unit/c/tmux_test.c"},"deprecated":false,"digest":{"line_hashes":["232063608063545694251461812487647294996","135399071238016763047535409142022088406","96249688255229574990695498906277129507","272524994958922618277235637913735398983","190314764333791239212371207457555990678","167730370991931416403533887945494627685","216824450044806261731370335210800381443"],"threshold":0.9},"id":"CVE-2026-47270-cd28597c","signature_type":"Line","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd"},{"target":{"file":"src/mem.c","function":"xmalloc"},"deprecated":false,"digest":{"function_hash":"192607803440488861342048580638874554237","length":136},"id":"CVE-2026-47270-d676ab81","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd"},{"source":"https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51","target":{"file":"src/pad.c","function":"pusb_pad_open_system"},"deprecated":false,"digest":{"function_hash":"126236955518588363702010008512527625718","length":618},"id":"CVE-2026-47270-e14b7ded","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"232135772049704262345430493436889995749","length":806},"id":"CVE-2026-47270-ec2c05f4","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"src/pad.c","function":"pusb_pad_should_update"},"deprecated":false},{"target":{"function":"pusb_get_process_envvar","file":"src/process.c"},"deprecated":false,"digest":{"function_hash":"38834797829152044862613013635930741978","length":712},"id":"CVE-2026-47270-f733508c","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd","target":{"file":"tests/unit/c/tmux_test.c","function":"main"},"deprecated":false,"digest":{"function_hash":"285048067924611644664548215597881830367","length":1172},"id":"CVE-2026-47270-fe298972"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}