A fifth critical vulnerability has been identified in the Linux kernel over the last two weeks, allowing a user to escalate their privileges in the system. Two working exploits have been published: sshkeysign_pwn enables an unprivileged user to read the contents of the host's private SSH keys /etc/ssh/ssh_host_*_key, while chage_pwn allows reading the contents of the /etc/shadow file containing user password hashes.
Details about the vulnerability were not scheduled for disclosure, but one security researcher was able to determine the nature of the vulnerability based on a proposed kernel patch, which allows reading files accessible only to the root user, such as /etc/shadow. The change added to the kernel corrected the logic of using the get_dumpable() function in ptrace when determining access level in the ptrace_may_access() function.
The vulnerability itself is caused by a race condition allowing unprivileged access to a file descriptor pidfd after accessing a file from a suid root process. At the moment between opening the file and dropping privileges in the suid program (for example, via the setreuid function), a situation arises where the application that launched the suid root program can access a file opened in the suid program through the pidfd descriptor, even if file access permissions do not allow it.
The exploitation window arises because the __ptrace_may_access() function skips the check for file access if the field task->mm is set to NULL after exit_mm() but before exit_files() is called. At that moment, the pidfd_getfd system call assumes that the user ID (uid) of the calling process matches the ID authorized to access the file. Notably, the issue had already been raised in 2020, but it remained unpatched.
In the exploit that retrieves the contents of /etc/shadow, the attack consists of repeatedly launching the /usr/bin/chage application with the suid root flag, which reads the contents of /etc/shadow. After the process forks, the pidfd_open system call is executed, and available pidfd descriptors are cyclically iterated through the pidfd_getfd system call and checked via /proc/self/fd. In the sshkeysign_pwn exploit, similar manipulations are carried out with the suid root program ssh-keysign.
The CVE identifier has not yet been assigned, and updates to the kernel and packages in the distributions have not been published. The vulnerabilities in the released kernels 7.0.7, 6.18.30, and 6.12.88, a few hours ago, have not been fixed. As of the time of this news, only a patch can be used. Possible workarounds to block the vulnerability are being discussed, such as setting sysctl kernel.yama.ptrace_scope=3 or removing the suid root flag from executable files in the system (at least from the utilities ssh-keysign and chage, used in exploits).
Update: The vulnerability has been assigned the CVE identifier CVE-2026-46333. Updates for the Linux kernel 7.0.8, 6.18.31, 6.12.89, 6.6.139, 6.1.173, 5.15.207, and 5.10.256 have been created to address the vulnerability. The status of vulnerability remediation in distributions can be assessed on the following pages: Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, Fedora.
Source: opennet.ru
