pam_usb: deny_remote bypass via compressed IPv6 addresses
Summary
pam_usb is a PAM module that authenticates Linux users with removable media. In affected versions, the deny_remote check does not recognise IPv6 addresses in compressed notation (for example ::1, fe80::1 or 2001:db8::1) when detecting active remote tmux sessions. A remote tmux client connected from such an address is therefore not detected, and pam_usb does not deny authentication as configured. The attacker needs a remote tmux session of the targeted user and the ability to authenticate with the USB medium.
Affected
- mcdope pam_usb from 0.8.0 to before 0.9.3
- Note: VulDB lists 0.9.0 to 0.9.2 as affected; 0.8.x should be treated as affected until the vendor confirms otherwise.
Fixed in
- Fixed in pam_usb 0.9.3
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild found.
- Publicly disclosed.
Our recommendation
- Update pam_usb to version 0.9.3 or later on all Linux systems where it is used.
- Until patched, check whether pam_usb is enabled for network-reachable PAM services such as sshd and whether tmux is used for remote administration.
- Disable pam_usb for services where it is not required.
- Verify the installed version with your package manager after patching.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-gc4c-v52c-2v34 github.com
- Fix commit a62513f3da871d6576d751de3482eb80b9ac79f3 github.com
- Pull Request #423 github.com
- pam_usb release 0.9.3 github.com
- CVE Record CVE-2026-64669 www.cve.org
- VulDB 435603 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:23.
Original description (NVD)
pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tmux_has_remote_clients() (src/tmux.c), the IPv6 detection regex required exactly four explicit colon-separated groups of 1-4 hex digits (e.g. 2001:0db8:85a3:0000). Any IPv6 address in compressed notation — including loopback (::1), link-local (fe80::1), and global unicast addresses (2001:db8::1) — did not match this pattern. As a result the remote-client check silently returned "no remote clients" even when a remote tmux client was connected from such an address. This issue has been patched in version 0.9.3.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.