pam_usb: Authentication policy bypass via IPv6 (CVE-2026-64669)

The pam_usb hardware authentication module contains a security flaw in the deny_remote feature, tracked as CVE-2026-64669. The vulnerability exists within pusb_tmux_has_remote_clients() in src/tmux.c, where an overly restrictive IPv6 regex fails to identify compressed IPv6 addresses. When a user connects to a remote tmux session using a compressed address (e.g., ::1 or 2001:db8::1), the module fails to detect the remote presence and treats the session as local, effectively bypassing the deny_remote policy. This vulnerability affects pam_usb versions 0.8.0 through 0.9.2.

Impact

Successful exploitation allows a user to bypass intended security policy restrictions that are designed to block authentication when a remote tmux session is active, potentially granting unauthorized access to the system via the hardware token if the remote session is active.

Recommendation

• Upgrade the pam_usb module to version 0.9.3 or later on all affected Linux systems.
• Audit PAM configuration files to determine if the deny_remote option is enabled, as the vulnerability only impacts systems utilizing this specific configuration.
• Prioritize patching for systems where hardware-based authentication is the primary barrier for remote-accessible accounts.