CVE-2026-48986

Name of the Vulnerable Software and Affected Versions pam usb versions prior to 0.9.2

Description An infinite loop Denial of Service (DoS) occurs during the process-tree walk when a parent process exits during authentication. The function usb get process parent id() fails to initialize the *ppid variable upon failure. In the pusb local login() function, this variable is reused as both input and output within a while loop; if the system cannot read /proc/<pid>/stat, the PID is not updated, preventing the loop from terminating. This results in the authentication process, such as sudo, sshd, or login, hanging until it is forcibly terminated.

Recommendations Update to version 0.9.2.