[PLUG] 9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros

[jeffv via plug <plug@lists.phillylinux.org>]

9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros

https://thehackernews.com/2026/05/9-year-old-linux-kernel-flaw-enables.html


Ravie LakshmananMay 21, 2026Linux / Vulnerability

Cybersecurity researchers have disclosed details of a vulnerability in 
the Linux kernel that remained undetected for nine years.

The vulnerability, tracked as CVE-2026-46333 (CVSS score: 5.5), is a 
case of improper privilege management that could permit an unprivileged 
local user to disclose sensitive files and execute arbitrary commands as 
root on default installations of several major distributions like 
Debian, Fedora, and Ubuntu. It's also codenamed ssh-keysign-pwn.

According to Qualys, which discovered the flaw, the problem is rooted in 
the kernel's __ptrace_may_access() function and was introduced in 
November 2016.

"The primitive is reliable and turns any local shell into a path to root 
or to sensitive credential material," Saeed Abbasi, senior manager of 
Threat Research Unit at Qualys, said.
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug