Reported by 2 outlets

Timeline

1. original reporting

   Linux "ssh-keysign-pwn" CVE-2026-46333 — 6-Year Race Condition Exposes SSH Keys and /etc/shadow

   gbhackers.com · 151d ago · May 16th, 2026

   Qualys researchers have disclosed a 6-year-old race condition in the Linux kernel's __ptrace_may_access() function that allows unprivileged local attackers to steal SSH private keys and /etc/shadow password hashes. Tracked as CVE-2026-46333, the vulnerability exploits a window during process exit: a privileged process like ssh-keysign calls exit_mm() (nulling memory) before exit_files() (closing file descriptors). During this gap, an attacker uses pidfd_getfd() to hijack open FDs to sensitive files. Because dumpability evaluation incorrectly handles kernel threads and threads without active memory maps, no CAP_SYS_PTRACE capability is required. A public PoC is available on GitHub. Affects all Linux kernels before the May 14, 2026 commit merging the fix. Distributions including Ubuntu, Debian, Arch, CentOS, and Raspberry Pi OS are vulnerable. Until patching, restrict local user access and audit ptrace permissions.

2. update from cyberpress.org

   CVE-2026-46333: Nine-Year-Old Linux Kernel Flaw Enables SSH Key Exfiltration and Root (Qualys TRU)

   cyberpress.org · 146d ago · May 21st, 2026

   Qualys TRU disclosed a critical logic flaw in the Linux kernel's __ptrace_may_access() function, present since November 2016 (v4.10-rc1), that allows unprivileged local attackers to steal SSH host private keys, read /etc/shadow password hashes, and execute arbitrary commands as root. The race condition exploits a window during process exit where memory maps are nulled before file descriptors close — pidfd_getfd() (introduced v5.6) pairs with this to hijack open FDs from dying privileged processes like ssh-keysign, chage, pkexec, and accounts-daemon. At default ptrace_scope=1, YAMA LSM permits access because the attacker is the parent of a spawned SUID child. Qualys confirmed working exploits on Debian 13, Ubuntu 24.04/26.04, Fedora 43/44. A public fix landed on May 14, with distribution patches following. Interim mitigation: set kernel.yama.ptrace_scope=2 (irreversible without reboot, breaks cross-process debuggers). Organizations should apply kernel updates urgently and rotate SSH host keys.