CVE-2026-44710: Mcdope Pam USB

Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days.

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model() directly to strcmp() without NULL checks. The GIO/UDisks API documentation states these accessors can return NULL for devices that do not expose the corresponding field. Passing NULL to strcmp() is undefined behaviour (typically a SIGSEGV). This vulnerability is fixed in 0.8.7.

Affected products

• Mcdope Pam USB: before 0.8.7 (fixed in 0.8.7)

Published 2026-05-27. Last modified 2026-06-17.