CVE-2026-44711: pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption

Synopsis

This is a symlink attack (also called a TOCTOU or path-traversal race) in pam_usb, a Linux PAM module that uses removable USB media for hardware-based authentication. An attacker with a local low-privilege account who can induce a victim to trigger a pam_usb authentication event can replace the pad directory or pad files with symbolic links pointing to arbitrary filesystem paths. Successful exploitation allows the attacker to bypass hardware authentication entirely and corrupt or overwrite files owned by root, up to and including system files. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as version 0.8.7 or a downstream fix is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; full administrative credentials are not needed.

• Victim interactionRequired

  A legitimate user must trigger a pam_usb authentication event (for example, by inserting a USB device and logging in) for the symlink substitution to be leveraged.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker has write access to the pad directory path; no race condition, special memory layout, or environmental tuning is required.

Blast Radius

• Bypasses the hardware authentication check enforced by pam_usb, allowing the attacker to authenticate without possessing the required USB device.
• Overwrites or corrupts arbitrary files on the host by redirecting the pad file path to root-owned system files, because pam_usb operates with elevated privilege during authentication.
• Persistent system compromise is achievable if critical files such as /etc/passwd, /etc/sudoers, or init scripts are targeted for corruption or replacement.
• No confidential data disclosure is indicated by the CVSS vector (Confidentiality: None), so the primary risk is integrity loss and availability disruption rather than data leakage.