9-Year-Old Linux Kernel Flaw Discovered — Root Access Possible on Debian, Ubuntu, and Fedora

 

Cybersecurity researchers at Qualys have uncovered a critical privilege escalation vulnerability in the Linux kernel that went undetected for nine years. Tracked as CVE-2026-46333 and codenamed "ssh-keysign-pwn", the flaw was quietly introduced into the kernel back in November 2016 and affects default installations of several of the most widely used Linux distributions, including Debian, Ubuntu, and Fedora.

What the Flaw Does

The vulnerability stems from improper privilege management in the kernel's __ptrace_may_access() function a core component that governs how one process can inspect or control another. An unprivileged local user who exploits this flaw can access highly sensitive files and escalate their privileges all the way to root, without requiring any special system configuration.

In practice, a successful attack can expose the contents of /etc/shadow the file containing hashed user passwords as well as private SSH host keys stored under /etc/ssh/. Beyond credential theft, the flaw can be weaponized to execute arbitrary commands as root through four separate exploit paths targeting the utilities chage, ssh-keysign, pkexec, and accounts-daemon.

As Saeed Abbasi, senior manager of Qualys' Threat Research Unit, put it, the flaw turns any local shell into a reliable path to root or to sensitive credential material.

Exploit Code Already Public

A proof-of-concept exploit was published shortly after a public kernel commit appeared, meaning the window between public awareness and potential active exploitation is already narrow. This is the latest in a string of Linux kernel privilege escalation vulnerabilities disclosed over the past month, following Copy Fail, Dirty Frag, and Fragnesia.

What to Do

The recommended course of action is to apply the latest kernel update provided by your Linux distribution as soon as possible. For systems where an immediate update is not feasible, a temporary workaround is available: raising the kernel parameter kernel.yama.ptrace_scope to a value of 2, which restricts ptrace access and limits the attack surface.

Qualys also advises that on any host that has allowed untrusted local users during the period of exposure, SSH host keys and locally cached credentials should be treated as potentially compromised. Rotating host keys and auditing any administrative material that may have resided in the memory of set-uid processes is strongly recommended.

Also: New "PinTheft" Exploit Targets Arch Linux Systems

In related news, a proof-of-concept for a separate local privilege escalation exploit dubbed PinTheft was also released this week, targeting Arch Linux systems. The exploit chains a double-free vulnerability in the Reliable Datagram Sockets (RDS) kernel module with io_uring fixed buffers to corrupt the page cache and achieve root access.

For PinTheft to work, the RDS module must be loaded on the target system, io_uring must be enabled, a readable SUID-root binary must be present, and the system must be running on x86_64 architecture. Organizations running Arch Linux should review their kernel module configurations and monitor for updates addressing this issue.

Resources