pam_usb: xfree() does not call explicit_bzero — sensitive cryptographic material may linger in freed heap_CVE-2026-48984
pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, the xfree() memory release helper in calls free() without first zeroing the buffer contents, releasing heap-allocated buffers containing sensitive data — including o...