HighPublic exploitVulnerability

CVE-2026-46333

Linux kernel ptrace authorization bypass and exit-time file-descriptor theft

Published May 15, 2026 · Updated 4 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

4 mentions · peak 2 in a dayToday

CVSS7.8High · v3.1

EPSS4.3%91st percentile

CISA KEVNoNot listed

In the wildReported1 exploitation record in Mallory

Vendors: Debian ProjectLinux

IdentifiersCVE-2026-46333CWE-863

Also known asssh_keysign_pwn

CVE-2026-46333 is an authorization flaw in Linux kernel ptrace access checks for tasks without an associated memory-management structure. The __ptrace_may_access() path does not preserve the intended dumpability restrictions after a task loses its memory image during exit. When credential checks align, an unprivileged local process can race a terminating privileged process and use pidfd_getfd() to duplicate privileged file descriptors. The same authorization weakness permits matching-credential access to kernel-thread details despite dropped capabilities. The correction preserves the task's last dumpability state, treats kernel threads as non-dumpable, and requires CAP_SYS_PTRACE to override the restriction.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can disclose root-owned secrets without directly granting root privileges. Public proofs of concept demonstrate theft of descriptors exposing SSH host private keys and password hashes from privileged helpers during process termination. Disclosure can enable subsequent impersonation, credential attacks, or elevated access, depending on the exposed material. The flaw also weakens capability-based privilege separation for access to kernel-thread details. Arbitrary kernel code execution or a root shell is not an established direct outcome of the demonstrated descriptor-theft attacks.

Mitigation

If you can’t patch tonight, do this now.

Until patching is complete, restrict ptrace-related functionality and limit untrusted local execution and interactive-shell access. For affected Siemens industrial devices without fixed firmware, restrict the additional GNU/Linux subsystem to trusted personnel and run only trusted applications. Dropping capabilities alone does not prevent the affected matching-credential access checks. These measures reduce exposure but do not replace the kernel fix.

Remediation

Patch, then assume compromise.

Install a vendor-supported kernel update containing the ptrace/get_dumpable() correction and reboot into the updated kernel, or apply an explicitly supported live patch for the running kernel. Fixed builds include RHEL 9.4 kernel 5.14.0-427.126.1.el9_4, RHEL 9.6 kernel 5.14.0-570.116.1.el9_6, and affected Google COS kernel packages at version 18867.381.132 or later. Other distributions and appliances require their corresponding vendor security updates; these version identifiers are not universal upstream minimums. Verify that the corrected kernel or live patch is active.

Public exploits

Exploits

7 exploits validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.

View more in app →

public-passwdThis repository is a small standalone local Linux exploit containing one Python script (passwd.py), a README, and a license. Its purpose is to change any local user's password without first spawning a root shell by chaining two vulnerabilities: CVE-2026-46333 to steal a readable file descriptor for /etc/shadow from the SUID chage utility, and CVE-2026-31431 (CopyFail) to convert that readable descriptor into a 4-byte arbitrary page-cache write primitive. The main exploit flow in passwd.py is: spawn /usr/bin/chage -l root repeatedly, obtain a pidfd for the child, brute-force duplicate candidate file descriptors with pidfd_getfd, identify the duplicated descriptor that resolves to /etc/shadow via /proc/self/fd/<n>, read shadow contents to locate the target user's entry, derive a new password hash using libcrypt.crypt while reusing the victim's existing salt, and overwrite the hash in /etc/shadow 4 bytes at a time using an AF_ALG authencesn(hmac(sha256),cbc(aes)) crypto socket and splice-based CopyFail logic. The script also includes cleanup/error handling for page-cache state and warns that the modification is temporary until reboot or cache clearing. Capabilities are limited to local post-authentication abuse: reading shadow hashes, selecting a username, and replacing that account's password hash in cache. There is no network C2, remote exploitation, persistence, or shell payload. Because the payload is a hardcoded credential modification workflow rather than a customizable framework module, the exploit is best classified as OPERATIONAL.st4rburn · Disclosed May 17, 2026 · python · markdown · localOperational public-passwdSmall standalone exploit repository with 3 files: GPL license, README, and a single Python entry point (passwd.py). The repository is a local privilege-abuse exploit, not a remote exploit and not part of a major framework. Its purpose is to change any local user's password without first obtaining a root shell by chaining two vulnerabilities: CVE-2026-46333 to steal a readable file descriptor for /etc/shadow from a transient /usr/bin/chage process, and CVE-2026-31431 (CopyFail) to convert that readable FD into a 4-byte arbitrary page-cache write primitive. passwd.py contains the full exploit flow. It loads libc and libcrypt via ctypes, implements get_shadow_fd() to repeatedly fork/exec chage -l root, opens a pidfd to the child, and brute-forces pidfd_getfd across candidate descriptors until one resolves via /proc/self/fd/* to /etc/shadow. It then reads/parses shadow entries, extracts the target user's existing hash and salt, prompts for a new password, hashes it with crypt(3) using the existing salt, and writes the replacement hash plus trailing field padding back into the cached /etc/shadow contents in 4-byte chunks. The write primitive is implemented with Linux AF_ALG crypto sockets using the authencesn(hmac(sha256),cbc(aes)) algorithm and splice-based manipulation described as CopyFail. The script includes cleanup/error handling for failed writes and warns that the modification is temporary because it affects page cache rather than durable on-disk state. Operationally, the exploit provides a practical local account takeover capability on vulnerable Linux systems: once the password hash is replaced, the attacker can authenticate as the chosen user with the known password. The README notes limitations: failure if the target entry is near the end of /etc/shadow, reuse of the old salt, and loss of the modified password after reboot or page-cache clearing. No C2, hardcoded IPs, or network callbacks are present; the notable fingerprintable artifacts are local file paths and the use of /usr/bin/chage, /etc/shadow, /proc/self/fd, /dev/null, and AF_ALG crypto sockets.Aurillium · Disclosed May 17, 2026 · python · markdown · localOperational CVE-2026-46333This repository contains a small standalone local Linux exploit PoC set for CVE-2026-46333, with 3 files total: two C programs and a README. It is not part of a larger exploit framework. The code targets a kernel race condition during privileged process exit, abusing pidfd_open/pidfd_getfd to duplicate file descriptors from dying SUID/root-owned processes before normal dumpability protections are enforced. Repository structure: CVE-2026-46333.c is the primary PoC and targets ssh-keysign from OpenSSH. It searches several standard filesystem locations for the ssh-keysign binary, forks a child to execute it silently, opens a pidfd to the child, then repeatedly scans file descriptors 3-63 across many attempts and rounds. For each duplicated descriptor, it resolves /proc/self/fd/<n> and checks whether the backing path matches an SSH host key naming pattern (contains both "ssh_host_" and "_key"). On success, it seeks to offset 0, reads the file contents, and prints the stolen private key material to stdout. The second code file, CVE-2026-46333-shadow.c, uses the same primitive against /usr/bin/chage. It executes "chage -l root" to induce opening of /etc/shadow, races pidfd_getfd against the exiting process, identifies a duplicated descriptor whose resolved path contains /etc/shadow, then reads and prints the shadow file contents. Capabilities: both programs are local information-disclosure exploits, not code-execution payloads. They steal sensitive file descriptors from privileged processes and dump the contents of protected files. The main practical outcomes are disclosure of SSH host private keys and password hashes from /etc/shadow, which could enable follow-on credential attacks or host impersonation. No network communication, C2, or remote callback behavior is present. The only fingerprintable observables are local filesystem paths and process interfaces such as ssh-keysign locations, /usr/bin/chage, /etc/shadow, /etc/ssh/ssh_host_*_key, /dev/null, and /proc/self/fd/%d. The README documents usage, impact, mitigation, and example output, and confirms the intended purpose as a working PoC for local privilege-boundary bypass via kernel race condition.0xBlackash · Disclosed May 17, 2026 · c · markdown · localOperational ptrace_may_dreamThis is a compact standalone local privilege escalation repository for CVE-2026-46333. It is not a framework module. The repo contains 5 files: a Makefile, README, headers, a D-Bus marshaling/payload file (dbus.c/dbus.h), and the main exploit (ptrace_may_dream.c). The Makefile builds a single binary, ptrace_may_dream, from ptrace_may_dream.c and dbus.c and links pthread, crypt, and util libraries. The exploit targets a Linux kernel race in ptrace_may_access() when mm == NULL during pidfd_getfd(2). The core idea is to race pidfd_getfd() against the exit of a privileged short-lived process so that ptrace access checks are skipped, allowing an unprivileged user to duplicate an open file descriptor from that process. Here, the chosen victim is accounts-daemon. The exploit searches /proc for the accounts-daemon PID, uses busctl to trigger activity in AccountsService, and specifically abuses SetIconFile to cause a short-lived child process. Multiple racing threads repeatedly call pidfd_getfd() against a guessed FD slot (default 5, matching the README note for dbus-broker) until one thread steals the D-Bus socket FD. Once the FD is stolen, the exploit writes a handcrafted D-Bus payload directly to that socket. dbus.c constructs three concatenated method calls on org.freedesktop.Accounts.User for the current user's object path: SetShell("/bin/bash"), SetAccountType(admin), and SetPassword(hash, ""). The password is hardcoded in dbus.h as pwned123 and hashed with crypt() using SHA-512 salt $6$xpl01t$. After sending the payload, the main program waits for accounts-daemon to apply the changes, verifies success by checking /etc/group for wheel membership and /etc/passwd for /bin/bash, then attempts to launch a root-capable shell path. Capabilities are therefore: local process enumeration, race-based FD theft via pidfd_getfd, direct D-Bus wire-format message construction, privilege escalation through AccountsService account modification, and post-exploitation shell access. There are no external network callbacks or C2 endpoints; all observables are local filesystem paths, procfs paths, D-Bus service/interface/object names, and external busctl invocations.sgkdev · Disclosed May 20, 2026 · c · makefile · localOperational CVE-2026-46333The supplied repository contains one standalone C source file, CVE-2026-46333.c, reported as 4202 bytes. No build files, documentation, framework integration, repository URL, or git reference were supplied; the size field reflects the reported source size rather than a verified archive size. The program claims to exploit a Linux process-exit race in which exit_mm precedes exit_files and an absent memory descriptor permits pidfd_getfd authorization checks to be bypassed. It selects the first executable ssh-keysign from four locations, repeatedly forks and executes it with standard streams redirected to /dev/null, and obtains a pidfd for the child. Across up to 800 rounds, it makes up to 25000 scans per round of child descriptors 3 through 63. Successfully duplicated descriptors are inspected through /proc/self/fd; paths containing both ssh_host_ and _key trigger an attempt to print the key contents. Descriptor handles are closed and children are reaped between rounds. This is an active local disclosure attempt, not a detection-only script. Its hardcoded payload is key extraction rather than command execution. There are no network destinations, remote callbacks, persistence mechanisms, or output files. The header mentions similar SUID tools, but the implementation targets only ssh-keysign. Neither the claimed CVE attribution nor exploit reliability is independently established by the supplied source. Success depends on the kernel race and on this argument-free, null-input invocation causing ssh-keysign to open privileged keys and retain their descriptors into the relevant exit window. The source does not validate those prerequisites and reports success even when a matched descriptor yields no readable key data. No obvious destructive or unrelated malicious behavior establishes that it is a fake exploit.dr4mohamed · Disclosed Oct 5, 2026 · c · localOperational CHARONSmall standalone local Linux exploit repository centered on a single C program, charon.c, plus a Makefile and documentation. The code is a dependency-free PoC/operational exploit for CVE-2026-46333, a Linux kernel bug in __ptrace_may_access during the exit_mm()/exit_files() window of a dying SUID/SGID process. The exploit races pidfd_getfd(2) against that transient state to duplicate privileged file descriptors from the target process. Repository structure is simple: README.md explains the vulnerability, affected kernels, usage, built-in lures, mitigations, and expected results; Makefile builds either a normal or static binary; charon.c contains the full exploit logic and CLI. No external framework is used. Main exploit capability: local sensitive-file disclosure / privilege-escalation primitive via FD theft. By default it targets /etc/shadow and prints the contents to stdout. It can also target SSH host private keys or arbitrary files if a suitable SUID/SGID bait opens them. The code includes built-in bait definitions for /usr/bin/chage, /usr/sbin/chage, /usr/bin/passwd, and /usr/lib/openssh/ssh-keysign, and supports auto-discovery of additional SUID/SGID binaries under common filesystem roots. The visible code path shows two phases: try built-in baits matching the requested target, then optionally auto-discover candidates. It also tracks statistics and distinguishes likely patched kernels when repeated pidfd_getfd attempts never succeed. This is clearly exploit code rather than a detector: it repeatedly forks/races privileged helper binaries and attempts to steal live file descriptors, returning success when it can read the requested file. Because the payload is fixed to reading files rather than spawning a shell, maturity is best classified as OPERATIONAL rather than WEAPONIZED.KaraZajac · Disclosed May 16, 2026 · c · makefile · localPoC CVE-2026-46333This repository is a small Go-based local proof-of-concept for CVE-2026-46333. It is not a remote exploit and contains no network functionality. The repo structure is simple: documentation in README.md and docs/, Go module metadata in go.mod/go.sum, a Linux-only implementation in main.go, and a non-Linux stub in main_nonlinux.go that exits with an informational message. The main exploit logic repeatedly spawns a user-chosen local binary, suppresses its standard streams by redirecting them to /dev/null, obtains a pidfd for the child process, and repeatedly probes file descriptors 3 through 499 using pidfd_getfd across up to 500 probe iterations and 500 rounds. If any descriptor duplication succeeds, it treats that as a race-condition hit, inspects each duplicated descriptor through /proc/self/fd/<n>, logs the resolved file path and permissions, and optionally reads up to 8 MiB from a specific captured file if its path matches the operator-provided capture path. Overall, the exploit capability is local file-descriptor theft/inspection and optional file-content disclosure from a spawned target process in a Linux environment supporting pidfd syscalls. The code is clearly positioned as a research/validation PoC rather than a weaponized exploit: no persistence, privilege escalation chain, remote delivery, or customizable post-exploitation payloads are present.studiogangster · Disclosed May 17, 2026 · go · markdown · localPoC

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Debian ProjectDebian Linuxoperating_system

Debian ProjectLinuxapplication

LinuxLinux Kerneloperating_system

External references

References

Activity feed

Recent activity

220 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

tenable nessus pluginsNews · Oct 23, 2026Rocky Linux 8.10 [CIQ] Security Update: bpftool / kernel / ker... | Tenable®A high-severity vulnerability affecting kernel packages in Rocky Linux 8.10 / CIQ Core 8.10. The listed CVSS v3 score is 7.8, indicating local access with low privileges, no user interaction, and high confidentiality, integrity, and availability impacts. Exploits and patched packages are available. Nessus detects affected package versions rather than directly testing exploitation.Read more ↗tenable nessus pluginsNews · Oct 23, 2026Rocky Linux 8.6 [CIQ] Security Update: bpftool / kernel / kern... | Tenable®A vulnerability affecting kernel packages in Rocky Linux 8.6 under CIQ FIPS 8.6 Compliant, addressed by advisory ciqsa-2026_1678. Its CVSS v3 score is 7.8; the vector indicates local exploitation requiring low privileges and no user interaction, with high confidentiality, integrity, and availability impacts. Exploits and security updates are available. Nessus detects affected package versions rather than testing exploitation.Read more ↗tenable cloud security pluginsNews · Oct 2, 2026Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6... | Tenable®A Linux kernel ptrace access-control flaw involving dumpability checks for threads without an associated memory image. UID-0 processes could access kernel-thread details despite dropping capabilities. The fix uses cached last-dumpability state for threads without a memory image and requires CAP_SYS_PTRACE to override restrictions. The reference rates the vulnerability High, with a CVSS v3 base score of 7.8, and reports exploit availability.Read more ↗tenable nessus pluginsNews · Sep 30, 2026CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / k... | Tenable®An important-severity locally exploitable vulnerability affecting a CentOS 8 package covered by the TuxCare CLSA-2026 advisory. The supplied CVSS v3 vector indicates low-privileged local exploitation with high impact to confidentiality, integrity, and availability.Read more ↗

+41 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity136Community discussion across Reddit, Mastodon, and other social sources.