Linux kernel privilege escalation zero-day CVE-2026-46333 turns any local shell into a path to root, affecting Debian, Fedora, and Ubuntu default installations - honest opinions

[IronWolf]

Qualys disclosed CVE-2026-46333 on May 21st, dubbed ssh-keysign-pwn. The vulnerability is an improper privilege management flaw in the kernel's ptrace_may_access function, introduced in November 2016 and present in default installations of Debian, Fedora, and Ubuntu. Qualys describes the exploit primitive as reliable, turning any local shell access into root privilege escalation and enabling disclosure of sensitive credential material including /etc/shadow and host private keys.

The flaw was introduced nearly ten years ago, has been present in every major Linux distribution's default installation since then, and was missed by security reviews across the entire period.

The Hacker News | #1 Trusted Source for Cybersecurity News

[Golden Tara]

A reliable local privilege escalation present in default Debian, Fedora, and Ubuntu installs since 2016 is a significant find. The duration is the alarming part. Nearly a decade of exposure across the most widely deployed Linux distributions

[TeaAndCode72]

The disclosure of /etc/shadow and host private SSH keys as part of the exploit is the detail that makes this most dangerous in practice. Root is bad. Having the credential material to move laterally to every other system that trusts those SSH keys is worse

[Amy]

Local shell access requirement is the mitigating factor. This does not help an attacker who has no access at all. It helps an attacker who already has a foothold, which is a significant escalation of an already bad situation

[TheLegendJohn32]

2016 introduction date means this vulnerability predates most of the organisations currently running the affected distributions. Every security review, penetration test, and vulnerability assessment in the intervening decade did not catch this

[Gareth5]

The ptrace subsystem has a history of privilege escalation vulnerabilities. This family of bugs has been a recurring theme and the defensive measures clearly did not prevent a new one sitting quietly for nine years

[NeutrinoX74]

Any multi-tenant environment where different users have local shell access is the high-risk deployment scenario. Cloud instances, shared development environments, university systems. The lateral movement potential is significant

[Bussin]

Qualys calling the primitive reliable is the critical word. A theoretical vulnerability with complex exploitation requirements is a different threat model from one where any attacker with local access can trivially escalate. This is the latter

[GlassKnight89]

The disclosure timing alongside the DBIR finding that exploitation windows have compressed to hours from months is unfortunate. Patch velocity on this one matters

[QuantumLeap34]

Vendor patches have been coordinated per the Qualys advisory. The mitigation process is straightforward for organisations with functional patch management. The risk is to those running unmanaged or poorly maintained Linux installations