CVE-2026-47269: pam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as local

Synopsis

An authentication bypass affects pam_usb, a Linux PAM module that uses removable USB media as a hardware authentication factor. The bug is reachable over the network with no authentication required, but exploitation also demands high attack complexity. A remote attacker who already possesses a registered USB device and can meet the required environmental conditions bypasses the deny_remote restriction, authenticating over SSH as if they were at a local terminal, gaining full read and write access to the system. No fix version has been published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target SSH service over the network; systems with SSH exposed on an IPv6 wildcard address (::) and AddressFamily any are the affected population.

• AuthenticationNot required

  No credentials or account privileges are required to initiate the authentication attempt that triggers the bypass.

• Victim interactionNot required

  No user on the target system needs to take any action for the exploit to succeed.

• Attack complexityDetail

  Exploitation requires the attacker to already possess a physical USB device registered to the target system, and the SSH daemon must be configured with an IPv6 wildcard listener - making success dependent on specific environmental conditions rather than a simple reliable trigger.

Blast Radius

• Reads files, credentials, and secrets accessible to the authenticated user account on the compromised system.
• Modifies files, configurations, and persisted data within the scope of the authenticated session.
• Allows lateral movement or privilege escalation attempts from an established interactive shell on the host.
• Effectively nullifies the deny_remote hardware authentication policy, undermining the security control the module was deployed to enforce.