The 4th Linux kernel flaw this month can lead to stolen SSH host keys
Original reporting by ZDNet

Linux systems face "ssh-keysign-pwn," a significant new security vulnerability. This flaw (CVE-2026-46333) allows unprivileged local users to read sensitive system files, including SSH host private keys and the shadow password file. Discovered by Qualys, the bug has existed for about six years within the kernel's ptrace access check logic, creating a critical blind spot. It is the fourth high-profile local security flaw in weeks, underscoring a persistent challenge for the OS.
The Flaw Explained
The vulnerability exploits a brief window during process shutdown, abusing the OpenSSH `ssh-keysign` helper binary. As privileged processes like `ssh-keysign` exit, a flaw in the kernel's `__ptrace_may_access()` logic momentarily skips crucial security checks. This oversight allows an unprivileged process to steal still-open file descriptors, granting access to root-only data. Though not a direct root shell, exfiltrating host keys and password hashes enables powerful lateral movement and long-term compromise.
The good news: a fix, penned by Linus Torvalds, is already rolled out in recent kernel updates, addressing the flaw across multiple branches. Users must update their Linux kernels to patched versions (e.g., 7.0.8, 6.1.173) immediately; it affects all kernels released before May 14, 2026. For those unable to update immediately, temporary mitigations like tightening Yama ptrace restrictions or disabling host-based SSH authentication carry significant trade-offs.
The "ssh-keysign-pwn" vulnerability serves as another stark reminder of the persistent security challenges facing the widely-deployed Linux ecosystem. While a patch is now available, addressing this information disclosure flaw that allowed unprivileged users to access sensitive data like SSH host keys and shadow passwords, the immediate onus falls on users and system administrators to prioritize rapid updates. Failing a timely patch, temporary mitigations exist, though they often introduce operational trade-offs, underscoring the delicate balance between security and functionality.