9-Year-Old Linux Kernel Bug Lets Local Users Escalate to Root on Major Distributions
Security researchers have revealed a long-standing defect in the Linux kernel that went unnoticed for roughly nine years. Tracked as CVE-2026-46333 and assigned a CVSS score of 7.1, the issue stems from improper handling of privileges and could allow an unprivileged local account on default installs of widely used distributions such as Debian, Fedora, and Ubuntu to leak sensitive files and run commands with root privileges. The flaw has been dubbed “ssh-keysign-pwn.”
Qualys, which identified the vulnerability, traced the root cause to the kernel routine __ptrace_may_access(), noting that the bug was introduced in November 2016. Saeed Abbasi, senior manager of the Threat Research Unit at Qualys, warned that the underlying primitive is dependable and effectively turns any local shell into a route to root or a way to access protected credential material.
Successful exploitation can reveal secrets like /etc/shadow and host private keys stored beneath /etc/ssh/*_key. It can also be leveraged to run arbitrary root-level commands; researchers demonstrated four distinct exploit paths that target utilities and services including chage, ssh-keysign, pkexec, and accounts-daemon. A proof-of-concept exploit surfaced last week soon after a public kernel commit made related changes visible.
CVE-2026-46333 is the most recent in a string of kernel vulnerabilities disclosed in the last month, following incidents dubbed Copy Fail, Dirty Frag, and Fragnesia. Distributors have published kernel updates to address the bug, and applying these patches is the recommended remediation.
For environments where an immediate kernel upgrade is not possible, a temporary mitigation is to raise the ptrace restrictions by setting the sysctl kernel.yama.ptrace_scope to 2. Qualys also advises treating SSH host keys and any locally cached credentials on systems exposed during the vulnerability window as potentially compromised: rotate affected host keys and audit any administrative secrets that may have been resident in the memory of set-UID processes.
Administrators should prioritize installing vendor kernel updates, apply the ptrace_scope workaround if needed, rotate any potentially exposed SSH host keys and credentials, and review set-UID process memory for sensitive administrative material.