Qualys has detailed a Linux kernel vulnerability, tracked as CVE-2026-46333, that it says allows unprivileged local users to read sensitive files and, under specific conditions, execute commands as root. Also known as ssh-keysign-pwn, the flaw affects the kernel’s __ptrace_may_access() access checks.
The vulnerability was publicly disclosed on May 15, 2026. Qualys published its detailed technical advisory on May 20, describing four exploit paths involving chage, ssh-keysign, pkexec and accounts-daemon. Fixes were available for Fedora 44 and AlmaLinux before May 21.
Exploitation requires the ability to execute code locally. An authenticated SSH session can provide that access, but the vulnerability does not itself provide unauthenticated remote access.
Canonical agreed with a CVSS 3.1 score of 5.5, classified as Medium, and assigned the issue a High Ubuntu priority because of the exposure of sensitive local information.
Reported exploit paths and their limits
Qualys described a race during process exit that can bypass a check intended to protect resources held by a process that has dropped its privileges. The researchers said their exploits could capture open file descriptors or authenticated communication channels and reuse them from unprivileged processes.
Qualys said it believed the underlying bug was introduced in November 2016, identifying v4.10-rc1 as the affected development release. Its four demonstrated exploits rely on pidfd_getfd(), a system call introduced in January 2020 with v5.6-rc1. The bug’s introduction date therefore does not establish that those particular attack paths were available throughout that period.
The company reported successful tests on default installations, with different requirements and distribution coverage for each path:
- chage: disclosure of /etc/shadow, which contains password hashes, on Debian 13, Ubuntu 24.04 and 26.04, and Fedora 43 and 44.
- ssh-keysign: disclosure of SSH host private keys under /etc/ssh/ on Debian 13 and Ubuntu 24.04 and 26.04.
- pkexec: root command execution on Debian 13, Ubuntu Desktop 24.04 and 26.04, and Fedora Workstation 43 and 44. This route requires an active user session at the local console, although the attacker can be logged in through SSH.
- accounts-daemon: root command execution on Debian 13 and Fedora Workstation 43 and 44. Qualys said Ubuntu’s default Yama setting, kernel.yama.ptrace_scope=1, blocks this particular route.
Qualys said its examination of exploitable programs was not exhaustive. Its reported results do not establish identical exposure across every Linux distribution or configuration.
Canonical said that, in the container deployments covered by its assessment, information disclosed through the flaw remains within the container.
Kernel updates and credential exposure
Fedora’s May 15 update notice identified kernel-7.0.8-200.fc44 for Fedora 44 as containing a fix for CVE-2026-46333. AlmaLinux said its production kernel updates released on May 16 also included the fix. Canonical’s guidance specifies that a reboot is required after installing Ubuntu kernel security updates.
Qualys and Canonical identified setting kernel.yama.ptrace_scope to 2 as a temporary mitigation where kernel updates could not immediately be applied. The setting restricts ptrace attachment to users with CAP_SYS_PTRACE privileges and affects debugging tools such as gdb and gcore for unprivileged users.
Qualys also recommended treating SSH host keys and locally cached credentials as potentially disclosed on systems that had allowed untrusted local users during the exposure window. Its guidance included rotating host keys and reviewing administrative material held in set-uid process memory.
Separate Linux privilege escalation flaws
The disclosure followed research into other Linux kernel vulnerabilities, including Fragnesia, tracked as CVE-2026-46300. AlmaLinux described Fragnesia as a separate flaw involving socket-buffer handling and the XFRM ESP-in-TCP receive path, allowing page-cache corruption that can lead to root privileges. Its technical cause differs from the ptrace access-check flaw in CVE-2026-46333.
The V12 security team also described PinTheft as a separate local privilege escalation exploit involving an RDS zerocopy double-free and io_uring fixed buffers. The team said the required RDS module was enabled by default only on Arch Linux among the common distributions it tested, limiting the applicability of that exploit.
