CVE-2026-64668

pam usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny remote feature in pam usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb tmux has remote clients() (src/tmux.c), the IPv6 detection pattern matched the address group and then immediately expected whitespace. On Linux systems with multi-homed network interfaces, w -i appends a zone index (scope identifier) to link-local IPv6 addresses — e.g. fe80::1%eth0. The %eth0 suffix appeared between the address and the next whitespace field, causing the regex match to fail even for an otherwise-matching remote session. The function returned "no remote clients" and granted access. This issue has been patched in version 0.9.3.