Nine-year Linux kernel flaw lets local users gain root

A nine-year-old Linux kernel vulnerability tracked as CVE-2026-46333 and assigned a CVSS score of 5.5 allows unprivileged local users to access sensitive files and gain root on default installations of Debian, Fedora and Ubuntu. Security firm Qualys disclosed the flaw, which it calls ssh-keysign-pwn, after a public kernel commit and the release of a proof-of-concept exploit.

Qualys traced the defect to improper privilege handling in the kernel function __ptrace_may_access(), a change introduced in November 2016. The company published technical details and an exploit analysis following the public code change and PoC release last week.

A successful exploit can reveal /etc/shadow and SSH host private keys under /etc/ssh/*_key. Qualys identified at least four exploit paths that lead to root execution by targeting chage, ssh-keysign, pkexec and accounts-daemon on default installations that have not been specifically hardened.

Qualys’ senior manager Saeed Abbasi described the primitive as “reliable and turns any local shell into a path to root or to sensitive credential material.”

The primary fix is to install the latest kernel updates provided by distribution vendors. For systems that cannot be updated immediately, setting kernel.yama.ptrace_scope to 2 via sysctl limits ptrace access and can reduce exposure. Hosts that allowed untrusted local users during the exposure period should treat SSH host keys and locally cached credentials as potentially disclosed and rotate keys and credentials as needed.

CVE-2026-46333 follows several recent Linux kernel disclosures, including defects known as Copy Fail, Dirty Frag and Fragnesia. A separate proof-of-concept called PinTheft demonstrates a local privilege escalation on Arch Linux when the Reliable Datagram Sockets (RDS) module is loaded, io_uring is enabled, a readable SUID-root binary is present, and x86_64 support is available. Researchers described PinTheft as stemming from an RDS zerocopy double-free that can be turned into a page-cache overwrite via io_uring fixed buffers.

System administrators should prioritize kernel updates from their distribution vendors, rotate SSH host keys for systems that allowed untrusted local users during the exposure window, and inspect any credentials that might have been resident in set-uid process memory during the exposure period.