pam_usb: deny_remote bypass via zone-indexed IPv6 addresses
Summary
pam_usb provides USB-based authentication on Linux and includes a deny_remote feature that should block USB authentication when the user has an active remote tmux session. In versions 0.8.0 up to 0.9.3 (excluded), the IPv6 pattern in pusb_tmux_has_remote_clients() fails when w -i appends a zone index such as %eth0 to a link-local address, which occurs on multi-homed Linux systems. The check then reports no remote clients and grants access. The conditions are a PAM service using pam_usb, a registered USB token and such a remote session.
Affected
- pam_usb 0.8.0 up to, but not including, 0.9.3 (per CNA record)
Fixed in
- Fixed in pam_usb 0.9.3
Workaround
- Unknown. No vendor-documented workaround found.
- Until the upgrade, do not rely on deny_remote as the only control for remotely reachable services.
Exploitation
- Not known to be exploited (OffSeq).
- No public proof of concept found.
- VulDB lists it as a 0-day.
Our recommendation
- Inventory hosts with pam_usb and check their versions.
- Upgrade to pam_usb 0.9.3 or later, or install the fixed package from your distribution.
- Check which PAM services load pam_usb, such as sshd, sudo, login and display managers.
- Monitor authentication logs for unexpected USB-based logins.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Commit a62513f3 (fix) github.com
- Pull Request #423 github.com
- pam_usb Release 0.9.3 github.com
- GitHub Security Advisory GHSA-7583-9cqv-j9rf github.com
- CVE Record CVE-2026-64668 www.cve.org
- VulDB 435598 vuldb.com
- OffSeq Radar CVE-2026-64668 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:23.
Original description (NVD)
pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tmux_has_remote_clients() (src/tmux.c), the IPv6 detection pattern matched the address group and then immediately expected whitespace. On Linux systems with multi-homed network interfaces, w -i appends a zone index (scope identifier) to link-local IPv6 addresses — e.g. fe80::1%eth0. The %eth0 suffix appeared between the address and the next whitespace field, causing the regex match to fail even for an otherwise-matching remote session. The function returned "no remote clients" and granted access. This issue has been patched in version 0.9.3.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.