CVE-2026-48066

Name of the Vulnerable Software and Affected Versions pam usb versions prior to 0.9.1

Description In src/log.c, a process-wide static pointer is written with the address of a stack-local variable during every PAM invocation. This behavior violates the PAM re-entrancy requirement—the ability of a function to be interrupted and safely called again before its previous invocation has finished—resulting in a data race when the PAM stack is invoked concurrently from multiple threads.

Recommendations Update to version 0.9.1.