pam_usb: Authentication bypass in deny_remote feature (CVE-2026-64668)

A logical flaw exists in the 'deny_remote' feature of pam_usb versions 0.8.0 to 0.9.2. The module checks for active remote tmux sessions by executing /usr/bin/w -i. On multi-homed Linux systems, this command appends a zone index to link-local IPv6 addresses (e.g., fe80::1%eth0). The regex used in pusb_tmux_has_remote_clients() expects whitespace immediately after the IP address and fails to account for the suffix. Consequently, the function erroneously concludes no remote clients are active, bypassing intended access restrictions. This is patched in version 0.9.3.

Impact

Successful exploitation allows for unauthorized authentication on systems configured to use pam_usb with the 'deny_remote' feature enabled, specifically when the environment utilizes multi-homed network interfaces and IPv6 link-local addresses.

Recommendation

• Upgrade the pam_usb authentication module to version 0.9.3 or later on all affected Linux systems.
• Audit PAM configurations to determine if deny_remote is active for pam_usb.
• Inventory Linux systems utilizing pam_usb for hardware-based authentication.