The 4th Linux kernel flaw this month can lead to stolen SSH host keys


caution symbol

ismagilov/iStock/Getty Images Plus

Follow ZDNET: Add us as a preferred source on Google.


ZDNET’s key takeaways

  • Another day, another Linux bug. 
  • There is a patch out now.  
  • However, it’s not available yet in most distros. 

Linux’s latest kernel flaw doesn’t have a fancy name; it’s just called “ssh‑keysign‑pwn.” It’s the fourth high‑profile local security hole to hit Linux in just a few weeks. This one enables ordinary users to quietly read some of the most sensitive files on a system, including Secure Shell (SSH) host private keys and the shadow password file.

The vulnerability gets its “ssh‑keysign‑pwn” nickname from one of the main exploitation paths: abusing OpenSSH’s ssh-keysign helper binary. Keysign -keysign is used for host‑based authentication and typically runs setuid root, opening the system’s SSH host keys before dropping privileges to complete its work.

Also: The third major Linux kernel flaw in two weeks has been found – thanks to AI

Just what we needed. Another annoying and potentially dangerous Linux bug.

The flaw explained

Security researchers at security company Qualys disclosed CVE‑2026‑46333, an information‑disclosure vulnerability in the Linux kernel’s ptrace access check. Qualys claims it has existed in one form or another for about six years. 

The flaw sits in the __ptrace_may_access() logic that runs as processes exit. Under certain conditions, the kernel skips normal “dumpable” checks once a process has dropped its memory mapping. This opens a brief window for another process to steal its file descriptors.

While ssh‑keysign‑pwn doesn’t hand over a full root shell by itself, the ability to exfiltrate host keys and password hashes is a powerful building block for lateral movement and long‑term persistence. In addition, with stolen SSH host keys, attackers can impersonate machines in host‑based trust relationships. With access to the shadow password directory, they can attempt offline password cracking and reuse those credentials across systems.

Also: Linux is getting a security wake-up call – why it was inevitable, and I’m not worried

Just what we always needed. A persistent hack that can keep stealing keys and passwords. 

In his patch, Linus Torvalds explained the problem exists because “We have one odd special case: ptrace_may_access() uses ‘dumpable’ to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). It’s not what this flag was designed for, but it is what it is.”

What that means for you and me is that by combining this logic error with the pidfd_getfd(2) system call, unprivileged users can reach into privileged processes that are in the middle of shutting down, grab their still‑open file descriptors, and then read from files that would normally be accessible only to root.

That wouldn’t be a big deal except that Qualys has shown via a proof‑of‑concept (PoC) exploit that the bug can be triggered reliably in practice, not just in theory. The good news is the fix is in. Linux stable maintainer Greg Kroah‑Hartman has already rolled out updates across multiple supported branches, including new releases such as 7.0.8, 6.18.31, 6.12.89, 6.6.139, 6.1.173, 5.15.207, and 5.10.256, all of which carry the ssh‑keysign‑pwn fix. 

What you need to do

You’ll want to move to one of these kernels ASAP. This hole affects all Linux kernels released before May 14, 2026. Otherwise, as one tired member of the Manjaro Linux team put it, “Don’t run your PC if you don’t need it. Lock yourself in and look over your shoulder.” Well, that’s certainly one way of dealing with it! 

Also: How to learn Claude Code for free with Anthropic’s AI courses

Until patched kernels are widely available, security teams do have some mitigation options, but each comes with trade‑offs. 

One quick and dirty workaround is to tighten Linux’s Yama ptrace restrictions by setting it with the command: 

sysctl kernel.yama.ptrace_scope=2. 

This disables ptrace for non‑root users and blocks the exploit, but it also breaks many debugging and monitoring workflows. This is not ideal for developer workflows. 

You can also reduce exposure by disabling host‑based SSH authentication and the ssh-keysign helper entirely on systems where they are not needed. This removes a primary avenue for stealing host keys. However, this also stops SSH in its tracks, which for many Linux systems is a non-starter.

Me? I’m going to be monitoring my systems and hoping the distros I use every day — Linux Mint, Ubuntu, AlmaLinux, openSUSE, and Rocky Linux — get patched by the end of the weekend. 





Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


If Game Two of their first-round playoff series with the Denver Nuggets saved the 2025-26 season for the Minnesota Timberwolves, Game Three showed why it should be saved. 

The Timberwolves were a different beast while decisively thumping the Nuggets, 113-96 Thursday night at Target Center, in a game that wasn’t nearly that close. These Wolves were the mythical creature we’d heard about in preseason lore, purposefully locked and loaded to be both marauding and staunch. They owned both ends of the court, gleefully transferring back and forth from irresistible force to immovable object. 

A quartet of Timberwolves deserve special mention, but it begins with Jaden McDaniels. After his team had toppled Denver to even the series at a game apiece Monday night, McDaniels used the sizable chip on his shoulder to etch some graffiti into the public discourse, casually castigating the most prominent Nuggets players by name as “bad defenders” in a matter-of-fact manner that had the media compelling him to confirm what he had just said. 

Trash talk is fleetingly fungible in the jaundiced social environment of 2026, functioning more like coupons than currency in that it needs to be rapidly leveraged before its expiration date. The common perception naturally was that McDaniels was calling out the Nuggets. But in a more subtle, profound way, he was also putting his teammates on notice. 

All season long the Timberwolves have procrastinated on their full potential, frequently demonstrating that their preseason talk about maturity and commitment was cheap. By contrast, those words uttered by McDaniels were expensive. He had just picked a fight with the opponent, leaving open the question of how many of his teammates would join him in the fray. 

That he would lead the charge was established early, after the Timberwolves’ top two scorers, Anthony Edwards and Julius Randle, had each missed a pair of open looks against Denver’s bad defenders in the game’s first 90 seconds.  

With the game still scoreless, the NBA’s best pick-and-roll combo, Nikola Jokic and Jamal Murray, were clustered around the foul line with Minnesota’s best defenders, McDaniels and Rudy Gobert. As they jammed up Jokic, McDaniels picked the ball loose and started sprint-dribbling the other way. To no one’s surprise, Donte “Ragu” DiVincenzo was also on his horse in transition, receiving a pass from McDaniels and then lobbing it back for a Jaden slam against a hapless Murray and Murray’s late-arriving teammate, Cam Johnson, who committed the foul that allowed McDaniels to finish with the “and-1” free throw. 

On the Timberwolves next offensive possession, McDaniels muscled his way to two offensive rebounds, feeding Ragu off the first one for a missed three-pointer, which he corralled for the second one and executed the putback in traffic. It was McDaniels 5, Nuggets 0, setting the tone for a game in which not only did the Wolves never trail, but never let the lead go under double digits after McDaniels made a consecutive pair of driving layups eight minutes into the game. 

“Spectacular. I thought his activity offensively in the first quarter was outstanding,” said Wolves coach Chris Finch after the game. “He was inspirational.” 

Among the most inspired were McDaniels fellow wing players, Ragu and Ayo Dosunmu. Ragu is exactly the kind of player who will have your back in a squabble, and his galvanized performance seemed borne of satisfaction that someone else had clarified the mission. As usual, the Timberwolves were at their best with him on the court: +20 in the 32:54 he played, -3 in the 15:06 he sat. 

“He makes so many hustle plays, momentum plays, different styles of plays.” Finch raved. “He’ll make a shot, get a transition bucket, he’ll rebound, get a steal, blow something up. So many different plays. He’s just a basketball player.”

Related: How the Timberwolves sparked a season-saving Game 2 comeback over the Nuggets in Denver

Then there was Ayo, whose fearless, blazing, bee-lines for the bucket were quicksilver kryptonite for a Nuggets defense that is neither swift nor rugged. “I’ve been waiting for him to wake up a little bit in this series,” Finch accurately observed. “The downhill mindset that he played with all season for us was back.”

Back with the sort of multipurpose propulsion that leaves witnesses with giddy whiplash. Ayo led the team with 25 points and 9 assists in 32 minutes of time-lapse hoops, the lone blemish being three clanks from long range. Why chuck treys when you can so easily undress players in the paint? Ayo was 10-for-12 on two-pointers and none of those dozen shots came from anywhere but beneath the rim. Five of his nine dimes likewise yielded layups or dunks, which means he personally accounted for 30 of the 68 points in the paint by the Timberwolves on Thursday, doubling up the Nuggets’ 34.

Which brings us to the non-wing in Game 3’s ring of honor, Rudy Gobert. For the third straight game, Gobert blunted the supposed advantage Denver had with the magical playmaker Nikola Jokic at the controls. Suffice to say that in the last five quarters, Jokic has shot 8-for-33 from the floor. If that continues, the Nuggets are toast in this series. 

When I asked Finch after the game if the herculean job Gobert was doing on Jokic made planning his defense simpler and better thus far, he replied, “Rudy is making all of us look good right now with his defense.” 

Amen.

If there is an asterisk on this game, it would be the absence of Denver’s brutishly versatile power forward Aaron Gordon. Nuggets coach David Adelman should be given a lot of credit for his honesty and transparency in dealing with the media during his first full season at the helm, but it came back to bite him and his team during the pregame presser, when he was clearly rattled and dejected by the sudden unavailability of Gordon, whose playing status went to “probable” to “out” in a period of a few hours due to a chronic calf strain. 

Gordon is far and away his team’s best defender, making the timing of his injury especially troublesome in the wake of McDaniels laying down his marker. Rattled is a good way to describe the entire team’s performance in the first quarter, an emotional wounding that needs to heal as fast as Gordon’s body if the Nuggets are going to be competitive in a series that had dramatically been flipped on its head over the past three days. 

That the Timberwolves played with such dominance despite mediocre outings from Ant and Randle would be a good thing for both of those current cornerstones to keep in mind. Ant was beset by foul trouble and Randle had a solid second quarter, but it stood out that neither player fully embraced what so often works on offense when the Wolves are at their best: Push the pace, move the ball, move without the ball, and make quick decisions. Ant and Randle can still be first among equals and blend into that catechism if they stay attuned to the possibilities of a greater good, one that all of sudden doesn’t have to end with them being postseason fodder for the Spurs or the Thunder. 

Not when you’ve got three wings at a collective peak, with a chaser of Rudy semi-clowning the Joker. 



Source link