Cybersecurity researchers disclosed a Linux kernel vulnerability this week that went undetected for nine years and could let a local attacker disclose sensitive files or run commands as root on default installs of some major distributions, including Debian, Fedora and Ubuntu. The issue, tracked as CVE-2026-46333, carries a CVSS score of 5.5.
KEY FACTS
- Flaw Improper privilege management in the kernel’s __ptrace_may_access() function.
- Age The bug was introduced in November 2016.
- Impact It can expose /etc/shadow and SSH host private keys.
- Exploitation Four paths were described through chage, ssh-keysign, pkexec and accounts-daemon.
- Mitigation Linux distributions have released kernel updates, and a temporary workaround raises kernel.yama.ptrace_scope to 2.
A technical analysis from Qualys said the flaw is rooted in the kernel’s __ptrace_may_access() function and can provide a reliable path from a local shell to root access or credential disclosure. The report said the issue could affect sensitive material stored in memory by set-uid processes.
The disclosure said successful exploitation could reveal /etc/shadow and host private keys under /etc/ssh/*_key. It also said arbitrary commands could be executed as root through multiple exploits targeting chage, ssh-keysign, pkexec and accounts-daemon.
A proof-of-concept exploit for the vulnerability was released last week, shortly after a public kernel commit emerged. The report said the flaw remained unnoticed for nine years after being introduced in November 2016.
Linux users are advised to install the latest kernel updates from their distributions. If patching cannot be done immediately, the temporary workaround is to set kernel.yama.ptrace_scope to 2.
Qualys said hosts that allowed untrusted local users during the exposure window should be treated as potentially exposed, with SSH host keys and cached credentials assumed compromised until reviewed and rotated if needed.
WHY IT MATTERS
This flaw matters because it can turn a local account into a route to root access and credential theft on systems that have not been updated. The impact depends on the distribution and system configuration, but the exposure window may require administrators to review keys and cached secrets as well as apply patches.