Linux Kernel CVE-2026-46333 Exposes SSH Keys and Enables Local Root Escalation

Researchers and vendors disclosed CVE-2026-46333, a Linux kernel flaw in __ptrace_may_access() that lets an unprivileged local user exploit a process-exit race to bypass authorization checks and steal file descriptors from privileged processes. The bug has existed since Linux v4.10-rc1, and exploitation became more practical with pidfd_getfd() introduced in v5.6-rc1. Qualys and public proof-of-concept authors showed the issue can expose /etc/shadow, leak OpenSSH host private keys through ssh-keysign, and in some cases execute commands as root via targets including chage, pkexec, and accounts-daemon on default Debian, Ubuntu, Fedora, AlmaLinux, and other distributions.

Linus Torvalds merged the upstream fix in commit 31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a, and stable kernel updates were released across multiple branches as distributions began shipping patched packages. Public exploit code appeared almost immediately after the fix became visible, increasing the urgency for defenders to patch and reboot affected systems, rotate potentially exposed SSH host keys and other credentials, and review systems for local privilege-escalation activity. Where immediate patching is not possible, several vendors and Qualys said raising kernel.yama.ptrace_scope to 2 or 3 can block known exploit paths, although maintainers cautioned that such settings are only a temporary workaround and may disrupt debugging tools.