# CVE-2026-48986: mcdope pam_usb infinite loop DoS in process-tree walk

Source: https://junglewise.ai/threats/cve-2026-48986-mcdope-pam-usb-infinite-loop-dos-in-process-tree-walk  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-48986 · Severity: medium · CVSS 4.7 · Published 2026-06-18

pam_usb is a Linux authentication module that allows users to log in using removable USB devices instead of passwords. A flaw in how the software tracks system processes can cause it to enter an infinite loop, effectively freezing the login process. This results in a denial-of-service where services like SSH, sudo, or local login become unresponsive and must be manually terminated by an administrator.

Technologies: [Mcdope Pam Usb](https://junglewise.ai/threats/technologies/pam-usb). Vendors: [Mcdope](https://junglewise.ai/threats/vendors/mcdope).

## Quick answers

**Is CVE-2026-48986 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48986 being exploited in the wild.

**How severe is CVE-2026-48986?** Medium severity, with a CVSS score of 4.7, published 18 June 2026.

**Which products and versions are affected?** Mcdope Pam Usb <= 0.9.1.

**Is there a fix for CVE-2026-48986?** A patch was published on 2026-05-23: Version 0.9.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48986 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-48986?** Check whether you run Mcdope Pam Usb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An infinite loop vulnerability (CWE-835) exists in pam_usb's process-tree walking logic. The function `usb_get_process_parent_id()` fails to initialize the parent PID pointer on failure. In `pusb_local_login()`, the same variable is used for both input and output in a while loop; if a parent process exits during authentication, `/proc/<pid>/stat` becomes unreadable, causing the function to fail without updating the PID. This results in the loop condition never being met, hanging the PAM-aware process (e.g., sshd, sudo). The issue is fixed in version 0.9.2 by ensuring the PID is initialized to zero on failure.

## Affected products

- mcdope pam_usb <= 0.9.1

## Timeline

- 2026-05-23: patched: Version 0.9.2 released
- 2026-05-24: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: CVE published to NVD

## References

- [https://github.com/mcdope/pam_usb/releases/tag/0.9.2](https://github.com/mcdope/pam_usb/releases/tag/0.9.2)
- [https://github.com/mcdope/pam_usb/security/advisories/GHSA-h28h-9hc3-v595](https://github.com/mcdope/pam_usb/security/advisories/GHSA-h28h-9hc3-v595)

## Related threats

- [pam_usb heap out-of-bounds read in display server handling](https://junglewise.ai/threats/cve-2026-64667-pam-usb-provides-hardware-authentication-for-linux-using)
- [pam_usb XRDP session bypass via environment variable](https://junglewise.ai/threats/cve-2026-64666-pam-usb-provides-hardware-authentication-for-linux-using)
- [mcdope pam_usb symlink race condition in pad directory creation](https://junglewise.ai/threats/cve-2026-48983-mcdope-pam-usb-symlink-race-condition-in-pad-directory-creation)
- [mcdope pam_usb race condition in one-time pad update](https://junglewise.ai/threats/cve-2026-48982-mcdope-pam-usb-race-condition-in-one-time-pad-update)
- [mcdope pam_usb XXE in configuration file parsing](https://junglewise.ai/threats/cve-2026-48981-mcdope-pam-usb-xxe-in-configuration-file-parsing)