Long‑Latent Linux Kernel Flaw Enables SSH Key Theft

Cyberkendra and Qualys TRU disclosed CVE-2026-46333, a high-severity Linux kernel vulnerability in __ptrace_may_access() that has existed in mainline for nearly nine years. Local low-privilege attackers can exploit a race during privileged processes' temporary drop in privileges, combined with pidfd_getfd(), to steal open file descriptors and execute commands as root. Qualys published PoCs targeting chage, ssh-keysign, pkexec and accounts-daemon and validated exploits on Debian 13, Ubuntu 24.04/26.04 and Fedora 43/44, including theft of SSH host private keys. Linus Torvalds committed the upstream fix (commit 31e62c2ebbfd) and major distributions — Debian, Fedora, Red Hat, SUSE, AlmaLinux, CloudLinux — have backported patches. The bug underscores urgent patching needs across Linux deployments.

Logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333)

Qualys disclosed on May 14, 2026 a critical Linux kernel local privilege escalation flaw named ssh-keysign-pwn that dates back at least to 2020. The bug in __ptrace_may_access() can skip dumpable checks when task->mm == NULL during a brief window as a process exits, allowing an unprivileged local user with the same UID to steal open file descriptors from high-privilege processes. Exploits can read SSH host private keys or /etc/shadow hashes; PoCs provided target ssh-keysign and chage. The issue affects all stable Linux kernels and distributions including Arch, Debian, Ubuntu, CentOS and Raspberry Pi OS. Linus Torvalds released patches on May 14; admins should apply kernel updates immediately to prevent key and credential theft.