ssh-keysign-pwn

CVSS N/ACVE-2026-46333
Race condition in the Linux kernel process exit sequence allows unprivileged users to steal file descriptors from exiting privileged processes, enabling theft of SSH host keys and /etc/shadow.

Details

Site
https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn
Discovered by
Qualys Security
Introduced
5.6
Fixed
31e62c2ebbfd

Timeline

  1. Jann Horn flags the general FD-theft shape via pidfd_getfd[1]
  2. Fix committed by Linus Torvalds[2]
  3. CVE-2026-46333 assigned, public disclosure[3]

Mitigation

No mitigation (other than upgrading your kernel) is known for this vulnerability.

Sources

  1. https://lore.kernel.org/all/20201016230915.1972840-1-jannh@google.com/
  2. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=31e62c2ebbfd
  3. https://nvd.nist.gov/vuln/detail/CVE-2026-46333

History