CVE-2026-46333Patch(debian / debian_linux)

CRITICALCVSS 7.1 · HIGH

Exploitation observed; activity peaked at 21 mentions and remains active

Immediate actions

Patch debian debian_linux systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you don't have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses 'dumpable' to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). It's not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional "drop capabilities" model doesn't make any difference for this all. Make it all make a *bit* more sense by saying that if you don't have a MM pointer, we'll use a cached "last dumpability" flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override.

debian CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn/

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-269

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

debian_linux
linux_kernel

Threat summary

Active exploitation appears in 8 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
129 mentions across 27 observed days

What's happening

Active exploitation reported across 8 signals
Exploit tool or code specified in 5 signals
PoC mentioned or linked in 19 signals
Patch or workaround mentioned in 56 signals
Technical details provided in 59 signals
Disclosure: 37 classified signals
General: 33 classified signals
Peaked 25d ago at 21 mentions (2026-05-16); latest day: 1
129 total mentions across 27 days

Affected systems

Vendors

debian linux

Products

debian_linuxlinux_kernel

2 versions affected across 2 products

Deep dive

Activity timeline129 mentions / 27d

Signal classification6 categories

Patch

4333.3%

Disclosure

3728.7%

General

3325.6%

PoC

86.2%

Active Exploitation

53.9%

Exploit

32.3%

Referenced assets72 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-15	12	Active Exploitation1Disclosure1General5Patch5
2026-05-16	21	Disclosure6General7Patch6PoC2
2026-05-17	10	Exploit1General5Patch2PoC2
2026-05-18	11	Disclosure3Exploit1General3Patch2PoC2
2026-05-19	3	Disclosure1Patch2
2026-05-20	16	Disclosure4General3Patch8PoC1
2026-05-21	15	Active Exploitation1Disclosure7General2Patch5
2026-05-22	7	Disclosure3Exploit1General1Patch1PoC1
2026-05-23	5	Active Exploitation1Disclosure3General1
2026-05-24	5	Disclosure2General1Patch2
2026-05-26	5	Disclosure1Patch4
2026-05-27	1	Patch1
2026-05-28	1	Disclosure1
2026-05-30	2	Active Exploitation1General1
2026-06-01	1	Disclosure1
2026-06-02	1	Patch1
2026-06-03	1	Disclosure1
2026-06-04	3	Disclosure1General1Patch1
2026-06-05	1	Patch1
2026-06-06	1	General1
2026-06-09	1	Active Exploitation1
2026-06-26	1	Disclosure1
2026-07-02	1	General1
2026-07-17	1	Patch1
2026-08-17	1	Patch1
2026-08-19	1	Disclosure1
2026-09-11	1	General1

Full discourse20 posts

elhacker.NET@elhackernet145d
Disclosure
Fallo crítico de Linux ‘ssh-keysign-pwn’ expone claves SSH y contraseñas Se ha revelada una vulnerabilidad crítica en el kernel de Linux, identificada como CVE-2026-46333 y apodada “ssh-keysign-pwn” https://blog.elhacker.net/2026/05/fallo-critico-de-linux-ssh-keysign-pwn.html
Post summary
A critical kernel vulnerability (CVE-2026-46333), dubbed ‘ssh-keysign-pwn’, has been disclosed, indicating that it could expose SSH keys and passwords; no successful exploitation or patch has yet been reported.
492632814920.8K
141.0K followersView on X
Ubuntu@ubuntu142d
Patch
Mitigations for "ssh-keysign-pwn" (CVE-2026-46333) Linux kernel vulnerability are available in Ubuntu. Read the blog for details: https://ubuntu.com/blog/ssh-keysign-pwn-linux-vulnerability-fixes-available https://t.co/4wAtbVXEHB
Post summary
Ubuntu has released mitigations for CVE-2026-46333, with details outlined in an official blog post.
670433311232.6K
704.1K followersView on X
The Hacker News@TheHackersNews141d
Disclosure
🛑 [New] 9-Year-Old Linux Kernel Bug = Local Root on Default Debian, Ubuntu & Fedora. https://thehackernews.com/2026/05/9-year-old-linux-kernel-flaw-enables.html CVE-2026-46333 (ssh-keysign-pwn) lets any unprivileged user steal /etc/shadow + SSH host keys and run commands as root. 🔸 Public PoC available 🔸 Patch your kernel NOW 🔸 Quick temp fix - sysctl kernel.yama.ptrace_scope=2
Post summary
The post announces a 9-year-old Linux kernel flaw (CVE‑2026‑46333) that permits local privilege escalation on Debian, Ubuntu, and Fedora, highlights a public PoC, and urges immediate kernel patching with an interim sysctl countermeasure.
98462629630.1K
1.9M followersView on X
Linux Kernel Security@linkersec127d
Disclosure
Logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333) Article about a logical bug in ptrace implementation that allows getting access to file descriptors of other processes and thus escalating privileges in certain scenarios. https://cdn2.qualys.com/advisory/2026/05/20/cve-2026-46333-ptrace.txt https://t.co/GgwEtmnIP5
Post summary
The advisory announces a logic bug in Linux's __ptrace_may_access function that allows processes to access other processes' file descriptors, potentially leading to privilege escalation.
22511668813.4K
10.4K followersView on X
kokumօtօ@__kokumoto144d
PoC
SSH秘密鍵やパスワードハッシュが露出するLinuxの脆弱性"ssh-keysign-pwn" ( CVE-2026-46333)が開示された。悪用ベクタはローカル。ptraceの__ptrace_may_access()におけるアクセス制御機構の不備。競合状態/TOCTOU。PoC公開あり。緩和策はカーネルパッチ。 https://cybersecuritynews.com/linux-kernel-vulnerability-ssh-keysign-pwn/
Post summary
CVE‑2026‑46333 is a local ptrace access‑control flaw that can expose SSH keys and password hashes; a PoC was released along with a kernel patch.
119071476.6K
7.6K followersView on X
Brad Spengler@spendergrsec141d
General
https://www.linkedin.com/pulse/ptracemaydream-cve-2026-46333-forgotten-too-soon-full-oldani-i0ghf/
Post summary
The provided text is only a link to a LinkedIn article about CVE‑2026-46333, with no additional details to support a specific classification.
018057326.1K
7.0K followersView on X
Juliano Rizzo@julianor138d
General
1/ From all the recent writeups, I pick a few to read carefully and enjoy while drinking 🧉 and eating chipa, the way I did before with every (yes) Bugtraq post. This week: Qualys ptrace LPE, CVE-2026-46333 — no AI Linux PDF RCE, CVE-2026-46529 — human+AI Both are worth reading:
Post summary
The tweet simply recommends reading recent writeups on CVE‑2026‑46333 and CVE‑2026‑46529 without providing additional details.
18062296.1K
9.5K followersView on X
Frank@jedisct1140d
Disclosure
CVE-2026-46333: Local Root Privilege Escalation and Credential Disclosure in the Linux Kernel ptrace Path https://blog.qualys.com/vulnerabilities-threat-research/2026/05/20/cve-2026-46333-local-root-privilege-escalation-and-credential-disclosure-in-the-linux-kernel-ptrace-path
Post summary
A Qualys blog post announces CVE-2026-46333, which allows local root privilege escalation and credential disclosure via the Linux kernel ptrace path.
015058225.5K
17.5K followersView on X
Doğan Dağdelen@DoanDadelen5138d
Patch
Linux sistemleri etkileyen kritik CVE-2026-46333 zafiyeti yayınlandı. Saldırganların sistemlerine sızmasına yol açabilecek bu açık için yamalar dağıtılmaya başlandı. Linux sunucularınızı ve sistemlerinizi acilen güncelleyin ya da güvenlik tedbirini alın. #LinuxSecurity
Post summary
A critical Linux vulnerability (CVE-2026-46333) is affecting systems; patches are being issued and users are urged to update urgently.
00039208.0K
19.1K followersView on X
Mohammad@Linuxmaster14141d
Disclosure
آسیب پذیری جدید کرنل (CVE-2026-46333) که حدود ۹ سال مخفی بوده!
Post summary
A new kernel vulnerability, CVE-2026-46333, which remained undisclosed for about nine years, has just been announced.
1104874.2K
4.4K followersView on X
إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi145d
General
🚨 ثغرة جديدة في لينكس من نوع (TOCTOU - Time Of Check Time Of Use) رقمها (CVE-2026-46333). هذي الثغرة ما تعطي صلاحيات (Root) مباشرة، بس تسمح للمستخدم العادي يقرأ ملفات المفروض ما يشوفها غير الـ (Root). والمشكلة إنها تستهدف ملفات حساسة جداً مثل مفاتيح (SSH) وملف (/etc/shadow). 🚨 ثغرة جديدة في لينكس من نوع (TOCTOU - Time Of Check, Time Of Use) رقمها (CVE-2026-46333). هذي الثغرة ما تعطي صلاحيات (Root) مباشرة، بس تسمح للمستخدم العادي يقرأ ملفات المفروض ما يشوفها غير الـ (Root). والمشكلة إنها تستهدف ملفات حساسة جداً مثل مفاتيح (SSH) وملف (/etc/shadow). التفاصيل: 👇 ⚙️ كيف طريقة الاستغلال وسبب المشكلة؟ في لينكس فيه برامج تشتغل بصلاحيات عالية وتفتح ملفات حساسة، مثل: 🔹 أداة (ssh-keysign) اللي تتعامل مع مفاتيح (SSH) الخاصة بالسيرفر. 🔹 أداة (chage) اللي تقرأ وتعدّل على ملف (/etc/shadow). المفروض المستخدم العادي ما يقرب هالملفات أبداً، بس الخلل يصير في "لحظة خروج البرنامج" من النظام. ⚠️ لما البرنامج يخلّص شغله، الـ (Kernel) يبدأ يقفل الموارد بترتيب معين. هذا الترتيب يفتح نافذة زمنية قصيرة جداً، فيها صلاحيات البرنامج تتغير لكن الـ (File Descriptors) للملفات الحساسة لسه مفتوحة! هذي بالضبط (Race Condition) كلاسيكية. المهاجم يستغل الجزء من الثانية ذا عشان يقرأ محتوى الملفات اللي فتحها البرنامج بصلاحيات أعلى منه. 💀 النتيجة؟ المهاجم يقدر يسرق مفاتيح (SSH) الخاصة بالسيرفر، أو يقرأ (Password Hashes) من ملف (/etc/shadow). 🔍 شرط الاستغلال: إن المهاجم يكون عنده وصول محلي (Local Access) بصلاحية يوزر عادي. يعني الثغرة مو عن بُعد، بس في بيئات معينة هذا الشرط ما يعتبر حماية حقيقية. 📍 وين تصير الثغرة خطيرة فعلاً؟ في أي بيئة فيها مستخدمين متعددين يشاركون نفس السيرفر، وتحديداً: 🔹 الاستضافة المشتركة (Shared Hosting). 🔹 سيرفرات (Jump Servers) اللي يدخل عليها فريق كامل. 🔹 سيرفرات المطورين و (Build Servers). 🔹 بيئات الجامعات ومختبرات التدريب.
Post summary
The post describes a TOCTOU race condition in Linux that allows local non‑root users to read privileged files such as SSH keys and /etc/shadow, but it does not provide a PoC, exploit code, patch, or evidence of active exploitation.
23126256.8K
50.0K followersView on X
Saeed Abbasi@saeed4bbasi141d
Disclosure
Our @qualys TRU advisory for CVE-2026-46333 is live. Local root impact in the Linux kernel ptrace path. The patch went public, PoCs followed, and defenders were left racing. The gap between patch and protection is becoming one of security’s defining problems, current disclosure was not built for this. https://cdn2.qualys.com/advisory/2026/05/20/cve-2026-46333-ptrace.txt
Post summary
Qualys has released a TRU advisory for CVE‑2026‑46333, a local‑root flaw in the Linux kernel ptrace path, and the public patch and PoCs are now available, but no evidence of active exploitation is provided.
112224136.8K
373 followersView on X
Canonical@Canonical142d
Patch
Mitigations for "ssh-keysign-pwn" (CVE-2026-46333) Linux kernel vulnerability are available in Ubuntu. Read the blog for details: https://ubuntu.com/blog/ssh-keysign-pwn-linux-vulnerability-fixes-available https://t.co/HodyPMhRFi
Post summary
Ubuntu has released mitigations for CVE‑2026‑46333, the 'ssh‑keysign‑pwn' Linux kernel vulnerability, and provides a blog link with details on the fixes.
0314232.6K
111.1K followersView on X
AlmaLinux@AlmaLinux139d
Patch
CVE-2026-46333 patches are live for AlmaLinux 8, 9 & 10. Community testing pushed them from testing → production faster than we could've managed alone. Get the patched kernels now if you haven't already! https://almalinux.org/blog/2026-05-15-ssh-keysign-pwn-cve-2026-46333/?utm_medium=social&utm_source=twitter
Post summary
The announcement confirms that patches for CVE‑2026‑46333 are now available for AlmaLinux 8, 9, and 10, urging users to update their kernels.
1912972.7K
12.4K followersView on X
Qualys@qualys141d
PoC
Qualys Threat Research Unit (#TRU) has discovered and published the full advisory for CVE-2026-46333, a nine-year-old flaw in the Linux kernel that turns any unprivileged local shell into local root privilege escalation and credential disclosure on default installations of major distributions. Our TRU team built four working exploits, each on default installs of Debian, Ubuntu, and Fedora, to exfiltrate SSH host private keys and execute arbitrary commands as root. Our vulnerability disclosure contains vital information on CVE-2026-46333 and how organizations and security teams can take immediate action to protect themselves. Learn more here: https://blog.qualys.com/vulnerabilities-threat-research/2026/05/20/cve-2026-46333-local-root-privilege-escalation-and-credential-disclosure-in-the-linux-kernel-ptrace-path #Linux #KernelSecurity #CVE #ThreatResearch #vulnerability
Post summary
Qualys TRU disclosed CVE‑2026‑46333, a Linux kernel privilege escalation flaw, and provided working exploit code for Debian, Ubuntu, and Fedora, while also offering guidance for mitigation.
01302183.9K
34.3K followersView on X
Chavenay🍎🐡👹🐧🦋@Chavenay146d
Disclosure
Et c’est reparti Debian est vulnérable à ssh-keysign-pwn (CVE-2026-46333) sur la plupart de ses versions stables actuelles. http://security-tracker.debian.org Voir si les autres distributions sont exposées @ponceto91 @yrougy @phaleon2
Post summary
The post announces that Debian’s stable releases are vulnerable to CVE‑2026‑46333 (ssh‑keysign‑pwn), referencing the Debian security tracker but providing no PoC, exploit, or mitigation details.
5831383.6K
332 followersView on X
Christophe Casalegno@Brain0verride145d
Patch
C'est presque devenu une habitude depuis quelques semaines : on a droit au "zero-day" du week-end ou du jour férié. Comme pour les vulnérabilités kernel & apache des semaines précédentes, la mitigation pour la CVE-2026-46333 a été déployée le jour même sur l'ensemble du parc de serveurs managés @WeAreScalarX , en attendant les correctifs officiels. J'ai lancé une première estimation statistique rapide via Elora, mon associée stratégique IA pour la suite des événements : - Kernel core strict : ~10 à 30 vulnérabilités critiques théoriques latentes - Kernel complet + drivers in-tree : ~50 à 150 - Kernel + modules externes/vendor/DKMS : potentiellement davantage Prospective basée sur les cycles de croissance du noyau, avec environ +400.000 lignes toutes les 9 à 10 semaines : ~1 vulnérabilité critique potentielle tous les 1 à 3 cycles de croissance. Censurer les modèles ne changera rien : la sécurité par l'obscurité ne fonctionne pas. Elle n'a jamais fonctionné. Des centaines de personnes comme moi ont déjà compris qu'il n'est pas nécessaire de refaire un fine-tuning complet pour modifier profondément le comportement d'un modèle local. Dans la plupart des cas, quelques ajustements ciblés de poids via un LoRA suffisent à contourner les limitations ajoutées et disposent de leurs propres modèles "uncensored". Ce n'est pas une incitation. C'est un constat technique. Faire comme si cette réalité n'existait pas ne protège personne. Les normes ne vous protègeront pas. Le vrai sujet, c'est l'architecture de défense, la mitigation rapide, la supervision, l'audit, la segmentation, la capacité d'intervention et l'anticipation. La sécurité ne doit pas dépendre de couches de politesse mais reposer sur une maîtrise réelle. Certains pensaient que l'IA allait faire disparaître l'infogérance, mais c'est tout le contraire : il n'a jamais été aussi critique de disposer de structures capables d'intervenir *avant* la sortie de correctifs officiels, car la capacité d'exploitation est devenue quasi-instantannée.
Post summary
The post reports that a mitigation was swiftly applied to CVE‑2026‑46333 across the operator’s servers, emphasizing proactive defense and awaiting official vendor patches, without detailing exploits or active attacks.
06016112.7K
7.1K followersView on X
DMNTR Network Solutions 👻 AS204773@weareDMNTRs145d
General
Hola @ubuntu lo mismo había que ponerse a trabajar en la CVE-2026-46333... https://x.com/hnakamur2/status/2055586569172734359
Post summary
The post merely notes that work should be started on CVE-2026-46333, without providing any technical details, exploit information, or mitigation.
2202454.8K
25.8K followersView on X
Welsh ICP Conviction 🏴󠁧󠁢󠁷󠁬󠁳󠁿🏉@ICPLEGEND1966144d
Disclosure
🚨 $ICP ♾️ by @dfinity vs another Web2 security nightmare: Linux “ssh-keysign-pwn” exposes the old internet again. Critical Linux kernel flaw: CVE-2026-46333 ("ssh-keysign-pwn") Potential impact: • SSH private key theft • /etc/shadow password hash exposure • Credential compromise • Lateral movement risk • Long-term MITM exposure until key rotation Researchers describe a race condition in Linux ptrace access handling that may let attackers steal privileged file descriptors during process shutdown. And once again, zoom out: Dirty Pipe Kernel flaws Token theft Identity compromise Exchange exploits Different headlines. Same architecture problem. The internet still largely depends on: • Servers • SSH keys • Password stores • Cloud operators • Trust assumptions $ICP by @dfinity took a different route: ♾️ Full stack apps hosted onchain ♾️ Internet Identity + passkeys ♾️ Chain-key cryptography ♾️ Verifiable compute ♾️ Reduced dependence on traditional infrastructure models How many more emergency patches before people ask whether patching the foundations forever is the real problem? The future internet may need fewer servers, fewer secrets, and fewer trust assumptions. @dfinity @dominic_w @PierreSamaties Support independent ICP research/content: 1e672d038cebc619d93186418fa98f6499dbdb9cfdfac54f366c61a4a4ee4362 #ICP #DFINITY #Linux #CyberSecurity #InternetComputer #Blockchain
Post summary
The tweet announces the newly disclosed CVE‑2026‑46333 kernel race condition that can steal SSH keys and credential data, but it provides no evidence of exploitation, tooling, or mitigation.
030280615
1.5K followersView on X
AlmaLinux@AlmaLinux125d
Patch
Patched kernels for CVE-2026-46333 are now in production repos. A single dnf upgrade and reboot gets you patched kernels for ssh-keysign-pwn and Fragnesia 👇 https://almalinux.org/blog/2026-05-15-ssh-keysign-pwn-cve-2026-46333/?utm_medium=social&utm_source=twitter
Post summary
The message announces that vulnerabilities in CVE-2026-46333 have been addressed with patched kernels, which can be installed by a simple dnf upgrade and reboot.
0602131.3K
12.4K followersView on X

CPE platform detail5 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

5 of 5 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	debian	debian_linux	11.0	-	-
OS	linux	linux_kernel	-	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-

Explore more

Back to dashboard debian CVEs linux CVEs debian_linux vulnerabilities

What researchers are saying

CVE-2026-46333

Ubuntu[verified]@ubuntuPatch

Ubuntu has released mitigations for CVE-2026-46333, with details outlined in an official blog post.

kokumօtօ[verified]@__kokumotoPoC

CVE‑2026‑46333 is a local ptrace access‑control flaw that can expose SSH keys and password hashes; a PoC was released along with a kernel patch.

Juliano Rizzo[verified]@julianorGeneral

The tweet simply recommends reading recent writeups on CVE‑2026‑46333 and CVE‑2026‑46529 without providing additional details.

Frank[verified]@jedisct1Disclosure

A Qualys blog post announces CVE-2026-46333, which allows local root privilege escalation and credential disclosure via the Linux kernel ptrace path.

Doğan Dağdelen[verified]@DoanDadelen5Patch

A critical Linux vulnerability (CVE-2026-46333) is affecting systems; patches are being issued and users are urged to update urgently.

Mohammad[verified]@Linuxmaster14Disclosure

A new kernel vulnerability, CVE-2026-46333, which remained undisclosed for about nine years, has just been announced.

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediGeneral

The post describes a TOCTOU race condition in Linux that allows local non‑root users to read privileged files such as SSH keys and /etc/shadow, but it does not provide a PoC, exploit code, patch, or evidence of active exploitation.

Saeed Abbasi[verified]@saeed4bbasiDisclosure

Qualys has released a TRU advisory for CVE‑2026‑46333, a local‑root flaw in the Linux kernel ptrace path, and the public patch and PoCs are now available, but no evidence of active exploitation is provided.