Critical Linux Kernel Flaw Exposes SSH Keys and Password Hashes A newly disclosed Linux kernel vulnerability, tracked as CVE-2026-46333 and dubbed "ssh-keysign-pwn," allows attackers to extract highly sensitive data including SSH private keys and password hashes from affected systems. The flaw stems from a race condition in the kernel’s ptrace access control logic, specifically within the `__ptrace_may_access()` function. ### How the Exploit Works The vulnerability arises when a privileged process (e.g., ssh-keysign or chage) shuts down. During this brief window, its memory context is cleared (mm = NULL), but its file descriptors remain open. An unprivileged local attacker can exploit this gap using `pidfd_getfd()` to steal these descriptors, bypassing intended permission checks. A proof-of-concept (PoC) exploit on GitHub demonstrates how attackers can repeatedly spawn processes to race against a privileged helper’s exit, successfully extracting file descriptors in 100–2000 attempts making it a practical threat. ### Impact & Risks - SSH Private Key Theft: Enables attackers to impersonate systems or users, conduct man-in-the-middle (MitM) attacks, and move laterally across networks. - Password Hash Exposure: Full read access to `/etc/shadow`, allowing offline cracking of credentials. - Cascading Compromises: Since SSH keys are often reused, a single breach can lead to wider network access. ### Affected Systems The flaw impacts most Linux distributions running kernels before the May 14, 2026 patch, including: - Ubuntu - Debian - Arch Linux - CentOS - Raspberry Pi OS Given the vulnerability’s six-year existence, many long-term deployments remain exposed. ### Mitigation & Response - Apply kernel patches for CVE-2026-46333. - Rotate all SSH keys, particularly on critical systems. - Audit access to sensitive files like `/etc/shadow`. - Monitor for suspicious `ptrace` or `pidfd` system calls. - Restrict local user access where possible, as exploitation requires local presence. With a public PoC exploit already available, the risk of active exploitation in the wild is heightened, underscoring the urgency for remediation.