{"id":"CVE-2026-64668","summary":"pam_usb: deny_remote bypassed by zone-indexed IPv6 addresses (fe80::1%eth0) in pusb_tmux_has_remote_clients","details":"pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tmux_has_remote_clients() (src/tmux.c), the IPv6 detection pattern matched the address group and then immediately expected whitespace. On Linux systems with multi-homed network interfaces, w -i appends a zone index (scope identifier) to link-local IPv6 addresses — e.g. fe80::1%eth0. The %eth0 suffix appeared between the address and the next whitespace field, causing the regex match to fail even for an otherwise-matching remote session. The function returned \"no remote clients\" and granted access. This issue has been patched in version 0.9.3.","aliases":["GHSA-7583-9cqv-j9rf"],"modified":"2026-11-12T07:07:27.785594372Z","published":"2026-11-11T03:50:14.037Z","database_specific":{"cwe_ids":["CWE-285","CWE-693"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64668.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64668.json"},{"type":"ADVISORY","url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-7583-9cqv-j9rf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64668"},{"type":"FIX","url":"https://github.com/mcdope/pam_usb/commit/a62513f3da871d6576d751de3482eb80b9ac79f3"},{"type":"FIX","url":"https://github.com/mcdope/pam_usb/pull/423"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mcdope/pam_usb","events":[{"introduced":"76ebe69d37a508f8e9251c40d27c771d23c02064"},{"fixed":"9993723a2836c7de547ea380af521ed5f5b51651"},{"fixed":"a62513f3da871d6576d751de3482eb80b9ac79f3"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0.8.0"},{"fixed":"0.9.3"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"a62513f3da871d6576d751de3482eb80b9ac79f3"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"0.9.3","range":[{"fixed":"9993723a2836c7de547ea380af521ed5f5b51651"}]}]}}],"versions":["0.9.2","0.9.1","0.9.0","0.8.7","0.8.4","0.8.3","v0.8.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64668.json","vanir_signatures":[{"source":"https://github.com/mcdope/pam_usb/commit/a62513f3da871d6576d751de3482eb80b9ac79f3","target":{"file":"tests/unit/c/tmux_test.c"},"deprecated":false,"digest":{"line_hashes":["8517107882020109253699706627864467631","282628003124055442113441505863420791442","188315405117747904042688771240933571394","171239135315065449617017126984300632726","74089929895454170237204112210053450887","43541209739609968033089485940883917558","312945990282683116075486031217520246429","320708772271444099268694453982604440413","264835870852153863794324479901112646792","290679738264679250824544552671537281557","200155414088401918541277479550838027744","161038106105606955932155363417804580959","234735377272175591539911935428649531948","25917097294665709085754353287887518267","144619260065441825587705668534421118054","159175815588075736876676437260992742145","52973868321592329985673198525541915216","124479159631479420260297803622533731227","235086892497719073797960883651307520718","137667838816706648581527670058680868136","20637179145957183856229608261650708597","332796629761027804365359885832984534844","135492944068161584472208796422231676179","257938890810988021890002255898458602487","218041725087334977588897247184501123368"],"threshold":0.9},"id":"CVE-2026-64668-22c69eea","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/a62513f3da871d6576d751de3482eb80b9ac79f3","target":{"file":"src/tmux.c","function":"pusb_tmux_get_client_tty"},"deprecated":false,"digest":{"function_hash":"85304093442309306958561625970780493267","length":2438},"id":"CVE-2026-64668-3fe84d00","signature_type":"Function"},{"id":"CVE-2026-64668-8a744295","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/a62513f3da871d6576d751de3482eb80b9ac79f3","target":{"function":"main","file":"tests/unit/c/tmux_test.c"},"deprecated":false,"digest":{"function_hash":"214098490627720411172817765504472924888","length":1295}},{"id":"CVE-2026-64668-9194422b","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/a62513f3da871d6576d751de3482eb80b9ac79f3","target":{"function":"__wrap_pclose","file":"tests/unit/c/tmux_test.c"},"deprecated":false,"digest":{"length":68,"function_hash":"338828011674840629100492590693857898054"}},{"source":"https://github.com/mcdope/pam_usb/commit/a62513f3da871d6576d751de3482eb80b9ac79f3","target":{"file":"src/tmux.c"},"deprecated":false,"digest":{"line_hashes":["226080691988756549068854693614704003483","80335620383754065917046091708665428749","141604653530896191369155048656706854563","65437542893221990867451260749078391766","250921903329881125426896598375944877327","89014164209863073317043333556093586189","27696004388285441983199282753507948867","26366837197151457343450476425191528795","113912389032876412710566413938912314511","303132266328765750599365968474723260221","183663505459748327013077507639221672560","216135172526694128241840975813152327480","27000875205397306422284815749397047271","90891988431819252702881270640245495059","14704008394003270076272522343462959305","216258394700465389209815431005014280514","52109500773471127968422209489228215821","279556971593894144356401251853194050050","170563616233811710086128431883537164185","210001532313148119069280482620113705421","11222224350846719820078095171241291641","304918471734994784947198414408897070315","234994737338627853112726272948306109514","299689409779747704662697803103459820078","328664760446642895906664580220430141441","74362311815621861681681000694822136448","302778039723912120703502973954519516810","123936534819939283218258268737451327682","59806997012205338353114349494929531951","159266956566545106428654371861469228224","171585387390045061641914957203142278278","123969140823009698749004932080966453415","307154254531305886924307623390280622206","246750640648859193051242551490049191685","290172061092320346245459330494325064656","227036889634842228798926558790298720267","176754167582930176387193808591473710914","289921279091682260006406479946097464346","268983985487261952408264016186368160302","68348075019334992703194751161633814462","213106175043207633826340735817405812970","36933192119078881894333136877198932318","220479173967051924028326538766007212485","181071843012891535376486203622316934400","178719126965015065132671227069781703928","208881814627329358095778271653872987003","143150314277239145702160612522681963158","290834917638593633567149024578788172452","116820931552185802120411371508948708052","16272188240084033662170060644267374784","258173430351910950529063064832098473561","227036889634842228798926558790298720267","126287989838229806054169441004618742231","197242980776668573134877064823830959261","76402401333834998732192940279479739335","318733179995431202642344759223070381734","281442291724510393654335451099855177305","250211721523071149677621110376155503721","277482745117891548980888895364817594672","337573651493869766532810828803207991760","267868390585593816517915983992887850017"],"threshold":0.9},"id":"CVE-2026-64668-e4371212","signature_type":"Line","signature_version":"v1"},{"digest":{"length":1554,"function_hash":"294321548634218806321402237792452968700"},"id":"CVE-2026-64668-ec5f64c9","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/a62513f3da871d6576d751de3482eb80b9ac79f3","target":{"file":"src/tmux.c","function":"pusb_tmux_has_remote_clients"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/9993723a2836c7de547ea380af521ed5f5b51651","target":{"file":"src/version.h"},"deprecated":false,"digest":{"line_hashes":["196826471672966929406198729402906788408"],"threshold":0.9},"id":"CVE-2026-64668-fc51f96e","signature_type":"Line"}],"vanir_signatures_modified":"2026-11-12T07:07:27Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}