9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros

Overview

Qualys Threat Research Unit (TRU) has disclosed CVE-2026-46333, a logic flaw in the Linux kernel's __ptrace_may_access() function that permits an unprivileged local user to disclose sensitive files and execute arbitrary commands as root on default installations of several major distributions. The bug has resided in mainline Linux since November 2016 (v4.10-rc1). Upstream patches and distribution updates are already available. Working exploits are circulating publicly, and administrators should apply vendor kernel updates without delay.

Technical Details

The vulnerability is a race condition during process exit. The do_exit() function runs exit_mm() before exit_files(), leaving a window where the process has no memory map (mm) but file descriptors are still present. The pidfd_getfd() syscall (added in v5.6-rc1) can succeed in that window when the caller's uid matches the target's, allowing an attacker to capture open file descriptors from a dying privileged process.

Impact

Qualys developed four working exploits targeting widely deployed userland programs:

• chage (set-uid-root or set-gid-shadow): discloses /etc/shadow. Tested on Debian 13, Ubuntu 24.04, Ubuntu 26.04, Fedora 43, and Fedora 44.
• ssh-keysign (set-uid-root): discloses host private keys under /etc/ssh/*_key. Tested on Debian 13, Ubuntu 24.04, and Ubuntu 26.04.
• pkexec (set-uid-root): executes arbitrary commands as root. Tested on Debian 13, Ubuntu Desktop 24.04 and 26.04, and Fedora Workstation 43 and 44.
• accounts-daemon (root daemon): executes arbitrary commands as root. Tested on Debian 13, Fedora Workstation 43, and Fedora Workstation 44.

Mitigation

Apply the kernel update from your distribution. Patched packages are available from Debian, Fedora, and other major vendors. Interim mitigation: raise kernel.yama.ptrace_scope to 2 (admin-only attach). Rotate SSH host keys and review cached credentials on affected hosts.