{"id":251085,"date":"2026-05-21T04:02:00","date_gmt":"2026-05-21T08:02:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/05\/21\/nine-year-old-linux-kernel-flaw-allow-attackers-to-exfiltrate-ssh-private-keys\/"},"modified":"2026-05-21T04:35:10","modified_gmt":"2026-05-21T08:35:10","slug":"nine-year-old-linux-kernel-flaw-allow-attackers-to-exfiltrate-ssh-private-keys","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/05\/21\/nine-year-old-linux-kernel-flaw-allow-attackers-to-exfiltrate-ssh-private-keys\/","title":{"rendered":"Nine-Year-Old Linux Kernel Flaw Allow Attackers to Exfiltrate SSH Private Keys"},"content":{"rendered":"

Nine-Year-Old Linux Kernel Flaw Allow Attackers to Exfiltrate SSH Private Keys<\/a><\/p>\n

https:\/\/cyberpress.org\/nine-year-old-linux-kernel-flaw\/<\/a><\/p>\n

Publish Date: 2026-05-21 04:02:00<\/a><\/p>\n

Source Domain: cyberpress.org<\/a><\/p>\n

A critical logic flaw\u00a0disclosed\u00a0in the Linux kernel since November 2016 has been publicly disclosed by the\u00a0Qualys Threat Research Unit (TRU), enabling unprivileged local attackers to steal SSH host private keys, read password hashes from\u00a0\/etc\/shadow<\/p>\n

The vulnera<\/span>bility\u00a0executes arbitrary commands as root on default installations of major Linux distributions.<\/p>\n

Tracked as\u00a0CVE-2026-46333\u00a0and assigned a high severity rating, the vulnerability affects all mainline Linux kernels from\u00a0v4.10-rc1 (November 2016)\u00a0through the present, representing nine years of exposure across enterprise fleets, cloud images, and container hosts. <\/p>\n

The flaw resides in the\u00a0__ptrace_may_access()\u00a0function within the Linux kernel\u2019s process tracing subsystem. <\/p>\n

Nine-Year-Old Linux Kernel Flaw<\/strong><\/h2>\n

During the brief window when a privileged process drops its credentials before fully exiting, its\u00a0dumpable\u00a0flag which should block external access is bypassed, Qualys said.<\/p>\n

An attacker can exploit this race condition by pairing it with the\u00a0pidfd_getfd()\u00a0syscall (introduced in v5.6-rc1, January 2020) to capture open file descriptors and authenticated inter-process channels from the dying privileged process and reuse them under their own UID.<\/p>\n

The root cause is precise:\u00a0pidfd_getfd\u00a0enforces access via\u00a0__ptrace_may_access(target, PTRACE_MODE_ATTACH_REALCREDS), but the dumpable check is skipped when the target\u2019s memory map (mm) is NULL. <\/p>\n

At the default\u00a0ptrace_scope=1, YAMA LSM permits access because the attacker is the parent of the SUID child it spawned making the exploit reliable and repeatable.<\/p>\n

Qualys developed and validated working exploits targeting widely deployed set-uid binaries and root daemons:<\/p>\n