Critical Linux Kernel Flaw CVE-2024-XXXX Lets Attackers Read SSH Keys

Key Takeaways

• A critical Linux kernel flaw, nicknamed “ssh-keysign-pwn” and identified as CVE-2026-46333, allows local attackers to steal sensitive data.
• The vulnerability enables the theft of SSH private keys and password hashes from /etc/shadow.
• Most Linux distributions running kernels prior to May 14, 2026, including Ubuntu, Debian, CentOS, and Raspberry Pi OS, are affected.
• A patch was released on May 14, 2026, and a public proof-of-concept (PoC) exploit is available, necessitating immediate action.

Linux Kernel Flaw Exposes SSH Keys and Password Hashes

A significant vulnerability within the Linux kernel has come to light, enabling local attackers to compromise systems by accessing highly sensitive information, including SSH private keys and password hashes. This flaw, designated CVE-2026-46333 and dubbed “ssh-keysign-pwn,” poses a substantial risk to a broad spectrum of Linux-based systems.

Technical Deep Dive into “ssh-keysign-pwn”

The root cause of this vulnerability lies in a logic error within the Linux kernel’s ptrace access control, specifically within the __ptrace_may_access() function. This function is designed to regulate how processes can inspect or interact with other processes, acting as a crucial security boundary. However, a race condition emerges from how the kernel’s “dumpability” checks are applied.

During the shutdown sequence of a privileged process, such as ssh-keysign or chage, a brief window exists where its memory context (mm = NULL) is cleared, yet its open file descriptors remain active. An unprivileged local attacker can exploit this transient state using the pidfd_getfd() system call to illicitly acquire these file descriptors. This method effectively circumvents the intended permission checks, granting unauthorized access to critical files that would otherwise be protected.

Security researchers, including those at Qualys, have highlighted the severe implications of this flaw:

• The ability to steal SSH private keys, allowing attackers to impersonate users or systems.
• The potential for man-in-the-middle (MitM) attacks until compromised keys are identified and rotated.
• Full read access to /etc/shadow, exposing password hashes for offline cracking.
• Facilitating lateral movement across network infrastructure through the use of stolen credentials.

The reuse of SSH keys across various environments means that the compromise of a single system can have widespread repercussions, potentially granting broader network access to an attacker.

Affected Systems and Patch Information

The “ssh-keysign-pwn” vulnerability impacts most Linux distributions utilizing kernel versions released before the patch on May 14, 2026. This extensive list includes popular distributions such as Ubuntu, Debian, Arch Linux, CentOS, and Raspberry Pi OS. Given that this flaw reportedly persisted for over six years, numerous long-term deployments are currently at risk.

The core issue stems from the kernel’s handling of processes that lack a memory context. The “dumpability” flag, initially intended for core dump control, is incorrectly reused in ptrace checks. As a process exits, its memory is freed before its file descriptors are fully cleaned up. During this critical transitional period, the kernel fails to adequately enforce access restrictions, creating an exploitable window for attackers to bypass security mechanisms.

According to a recent communication from Clandestine, kernel patches have been deployed to rectify this issue. These patches tighten the logic and mandate explicit privileges, such as CAP_SYS_PTRACE, for accessing such processes, thereby closing the exploitation window.

What You Should Do

• Immediately apply the latest kernel patches that address CVE-2026-46333.
• Rotate all SSH keys, prioritizing those on critical systems, as a public proof-of-concept (PoC) exploit has been released.
• Conduct an audit of access permissions for sensitive files, particularly /etc/shadow.
• Implement monitoring for any suspicious activities involving ptrace or pidfd-related system calls.
• Where feasible, restrict local user access, as successful exploitation of this vulnerability requires local presence on the system.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.