CVE-2026-48064: pam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypass

Synopsis

An authentication bypass vulnerability in pam_usb (the PAM hardware-authentication module for Linux) allows a remote attacker to reach the USB device authentication step over the network without being blocked by the remote-host denial logic. When a PAM service is configured with deny_remote=false, the PAM_RHOST check that should reject connections from remote daemons such as XDMCP servers is also disabled, letting a genuine remote XDMCP session proceed directly to USB device verification instead of being turned away. Successful exploitation gives the attacker full read, write, and availability impact on the affected system. No fix versions have been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available as soon as a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target service over the network; the vulnerability is exposed through XDMCP or similar remote daemon connections that set PAM_RHOST.

• AuthenticationNot required

  No credentials or account are required before triggering the bypass; the flaw occurs in the pre-authentication gate that decides whether a remote session is even allowed to proceed.

• Victim interactionNot required

  No action by a logged-in user or administrator is needed; the attacker sends a remote connection and the bypass occurs automatically.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must meet specific environmental conditions, such as a PAM service configured with deny_remote=false and an accessible XDMCP endpoint, rather than exploiting a universally reachable path.

Blast Radius

• A successful attacker gains unauthorized access to the target system's authentication context, allowing them to read sensitive files, stored credentials, and session tokens accessible to the authenticated user.
• The attacker can modify persisted files, configuration, and data on the system with the privileges of the account they authenticate as.
• The attacker can crash or disrupt the affected service or system processes, causing a denial of service for legitimate users.
• Because the bypass sidesteps the hardware USB token requirement, any system relying on pam_usb as a second factor loses that control entirely for affected service configurations.