CVE-2026-48983

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48983", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-26T23:26:07.975Z", "datePublished": "2026-06-18T19:07:56.198Z", "dateUpdated": "2026-06-22T12:41:34.711Z"}, "containers": {"cna": {"title": "pam_usb: TOCTOU race condition in pad directory creation allows symlink substitution", "problemTypes": [{"descriptions": [{"cweId": "CWE-367", "lang": "en", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-4j8q-67fq-3xc3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-4j8q-67fq-3xc3"}, {"name": "https://github.com/mcdope/pam_usb/releases/tag/0.9.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/mcdope/pam_usb/releases/tag/0.9.2"}], "affected": [{"vendor": "mcdope", "product": "pam_usb", "versions": [{"version": "< 0.9.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-18T19:07:56.198Z"}, "descriptions": [{"lang": "en", "value": "pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, a symlink race condition exists in per-device and per-user pad directory creation. pam_usb uses a check-then-act pattern: it calls lstat() to test for existence and then calls mkdir() separately to create the directory. A local attacker can win the race between these calls by replacing the target path with a symlink to a directory they control. If successful, one-time pad files may be written to an attacker-controlled location, potentially exposing future pad values before use or disrupting authentication. This issue has been fixed in version 0.9.2."}], "source": {"advisory": "GHSA-4j8q-67fq-3xc3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-22T12:41:19.864255Z", "id": "CVE-2026-48983", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T12:41:34.711Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48983", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T12:41:19.864255Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T12:41:27.836Z"}}], "cna": {"title": "pam_usb: TOCTOU race condition in pad directory creation allows symlink substitution", "source": {"advisory": "GHSA-4j8q-67fq-3xc3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "mcdope", "product": "pam_usb", "versions": [{"status": "affected", "version": "< 0.9.2"}]}], "references": [{"url": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-4j8q-67fq-3xc3", "name": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-4j8q-67fq-3xc3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mcdope/pam_usb/releases/tag/0.9.2", "name": "https://github.com/mcdope/pam_usb/releases/tag/0.9.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, a symlink race condition exists in per-device and per-user pad directory creation. pam_usb uses a check-then-act pattern: it calls lstat() to test for existence and then calls mkdir() separately to create the directory. A local attacker can win the race between these calls by replacing the target path with a symlink to a directory they control. If successful, one-time pad files may be written to an attacker-controlled location, potentially exposing future pad values before use or disrupting authentication. This issue has been fixed in version 0.9.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-18T19:07:56.198Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48983", "state": "PUBLISHED", "dateUpdated": "2026-06-22T12:41:34.711Z", "dateReserved": "2026-05-26T23:26:07.975Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-18T19:07:56.198Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pam_usb", "vendor": "mcdope", "versions": [{"status": "affected", "version": "< 0.9.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, a symlink race condition exists in per-device and per-user pad directory creation. pam_usb uses a check-then-act pattern: it calls lstat() to test for existence and then calls mkdir() separately to create the directory. A local attacker can win the race between these calls by replacing the target path with a symlink to a directory they control. If successful, one-time pad files may be written to an attacker-controlled location, potentially exposing future pad values before use or disrupting authentication. This issue has been fixed in version 0.9.2."}, {"lang": "es", "value": "pam_usb proporciona autenticaci\u00f3n de hardware para Linux utilizando medios extra\u00edbles ordinarios. En versiones anteriores a la 0.9.2, existe una condici\u00f3n de carrera de enlace simb\u00f3lico en la creaci\u00f3n de directorios de pad por dispositivo y por usuario. pam_usb utiliza un patr\u00f3n de verificar y luego actuar: llama a lstat() para comprobar la existencia y luego llama a mkdir() por separado para crear el directorio. Un atacante local puede ganar la carrera entre estas llamadas reemplazando la ruta de destino con un enlace simb\u00f3lico a un directorio que controla. Si tiene \u00e9xito, los archivos de pad de un solo uso pueden escribirse en una ubicaci\u00f3n controlada por el atacante, exponiendo potencialmente valores de pad futuros antes de su uso o interrumpiendo la autenticaci\u00f3n. Este problema ha sido corregido en la versi\u00f3n 0.9.2."}], "id": "CVE-2026-48983", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48983", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-22T12:41:19.864255Z", "version": "2.0.3"}}]}, "published": "2026-06-18T20:16:14.657", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/mcdope/pam_usb/releases/tag/0.9.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-4j8q-67fq-3xc3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.9.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "pam_usb", "source": "cna", "vendor": "mcdope"}, "product": "pam_usb", "vendor": "mcdope"}], "created": "2026-06-18T21:15:03.710818+00:00", "updated": "2026-06-18T21:30:16.139948+00:00", "vendors": ["mcdope", "mcdope$PRODUCT$pam_usb"]}