# CVE-2026-47270: pam_usb race condition in remote session detection

Source: https://junglewise.ai/threats/cve-2026-47270-pam-usb-race-condition-in-remote-session-detection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-47270 · Severity: medium · CVSS 6.3 · Published 2026-05-27

pam_usb is a tool that allows users to log into Linux systems using a USB drive as a physical key. A flaw in how the software handles multiple login attempts at once can cause it to incorrectly identify whether a user is logging in locally or remotely. This could allow an attacker to bypass security restrictions intended to block remote access, potentially gaining unauthorized entry to the system.

Technologies: [Mcdope Pam Usb](https://junglewise.ai/threats/technologies/pam-usb). Vendors: [Mcdope](https://junglewise.ai/threats/vendors/mcdope).

## Quick answers

**Is CVE-2026-47270 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47270 being exploited in the wild.

**How severe is CVE-2026-47270?** Medium severity, with a CVSS score of 6.3, published 27 May 2026.

**Which products and versions are affected?** Mcdope Pam Usb < 0.9.0.

**Is there a fix for CVE-2026-47270?** A patch was published on 2026-05-17: Fixes committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47270 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-47270?** Check whether you run Mcdope Pam Usb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The pam_usb module prior to version 0.9.0 utilizes the non-reentrant strtok() function in three critical functions: pusb_tmux_get_client_tty(), pusb_tmux_has_remote_clients(), and pusb_get_process_envvar(). Because strtok() uses a global static pointer, concurrent authentication threads in display managers like GDM can cause race conditions that corrupt the tokenization state. This leads to incorrect parsing of tmux session data or /proc environment scans used for remote-session detection. Furthermore, the module incorrectly passed pointers from getenv() directly to strtok(), causing permanent corruption of the process environment block by inserting NUL bytes. These issues can result in the 'deny_remote' feature failing to block remote sessions or incorrectly blocking local ones. The vulnerability is fixed in version 0.9.0 by migrating to strtok_r() and using private heap copies of environment variables.

## Affected products

- mcdope pam_usb < 0.9.0

## Timeline

- 2026-05-17: patched: Fixes committed to repository
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE published to NVD

## References

- [https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51](https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51)
- [https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd](https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd)
- [https://github.com/mcdope/pam_usb/security/advisories/GHSA-j3xw-vc43-x7jg](https://github.com/mcdope/pam_usb/security/advisories/GHSA-j3xw-vc43-x7jg)

## Related threats

- [pam_usb heap out-of-bounds read in display server handling](https://junglewise.ai/threats/cve-2026-64667-pam-usb-provides-hardware-authentication-for-linux-using)
- [pam_usb XRDP session bypass via environment variable](https://junglewise.ai/threats/cve-2026-64666-pam-usb-provides-hardware-authentication-for-linux-using)
- [mcdope pam_usb symlink race condition in pad directory creation](https://junglewise.ai/threats/cve-2026-48983-mcdope-pam-usb-symlink-race-condition-in-pad-directory-creation)
- [mcdope pam_usb race condition in one-time pad update](https://junglewise.ai/threats/cve-2026-48982-mcdope-pam-usb-race-condition-in-one-time-pad-update)
- [mcdope pam_usb XXE in configuration file parsing](https://junglewise.ai/threats/cve-2026-48981-mcdope-pam-usb-xxe-in-configuration-file-parsing)