Linux Kernel Vulnerability “ssh-keysign-pwn” Lets Attackers Read SSH Keys and Shadow Passwords

Cybersecuritynews •Dhivya • May 16, 2026

A newly disclosed Linux kernel vulnerability is raising serious concerns across the security community, as it allows attackers to access highly sensitive data, including SSH private keys and password hashes, on affected systems. Tracked as CVE-2026-46333, the flaw has been nicknamed “ssh-keysign-pwn” and impacts a wide range of Linux distributions. Linux Kernel Vulnerability “ssh-keysign-pwn” The issue originates in […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Linux Kernel Vulnerability Exposes SSH Keys and Passwords A newly discovered Linux kernel vulnerability, tracked as CVE-2026-46333 and nicknamed 'ssh-keysign-pwn', allows unprivileged users to access sensitive files such as SSH host keys and the shadow password file. This flaw has existed for approximately six years and was disclosed by Qualys. The vulnerability arises from a logic error in the ptrace_may_access() function, which fails to enforce proper access controls during process termination. Public exploits for this vulnerability were released shortly after its disclosure, leading to urgent patching efforts across multiple Linux distributions. Affected systems include AlmaLinux 8, 9, and 10, with patches already available in testing repositories. Security experts recommend tightening ptrace_scope settings as a mitigation strategy. The flaw poses a significant risk for lateral movement and long-term persistence in compromised environments. 13 sources 72

Extracted Entities

Linux Kernel Vulnerability “ssh-keysign-pwn” Lets Attackers Read SSH Keys and Shadow Passwords

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)