9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros

9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros Ravie LakshmananMay 21, 2026Linux / Vulnerability Cybersecurity researchers have disclosed details of a vulnerability in the Linux kernel that remained undetected for nine years. The vulnerability, tracked as CVE-2026-46333 (CVSS score: 5.5), is a case of improper privilege management that could permit an unprivileged local user to disclose sensitive files and execute arbitrary commands as root on default installations of several major distributions like Debian, Fedora, and Ubuntu. It's also codenamed ssh-keysign-pwn. According to Qualys, which discovered the flaw, the problem is rooted in the kernel's __ptrace_may_access() function and was introduced in November 2016. "The primitive is reliable and turns any local shell into a path to root or to sensitive credential material," Saeed Abbasi, senior manager of Threat Research Unit at Qualys, said. Successful exploitation of the flaw could permit a local attacker to disclose /etc/shadow and host private keys under /etc/ssh/*_key, as well as execute arbitrary commands as root through four different exploits targeting chage, ssh-keysign, pkexec, and accounts-daemon. The disclosure comes as a proof-of-concept (PoC) exploit for the vulnerability was released last week, shortly after a public kernel commit emerged. CVE-2026-46333 is the latest security vulnerability disclosed in the Linux kernel after Copy Fail, Dirty Frag, and Fragnesia over the past month. It's recommended to apply the latest kernel update released by Linux distributions. If the updates cannot be carried out immediately, temporary workarounds include raising "kernel.yama.ptrace_scope" to 2. "On hosts that have allowed untrusted local users during the exposure window, treat SSH host keys and locally cached credentials as potentially disclosed," Qualys said. "Rotate host keys and review any administrative material that lived in the memory of set-uid processes." The development follows the release of a PoC for a local privilege escalation flaw called PinTheft that allows local attackers to gain root privileges on Arch Linux systems. The exploit requires the Reliable Datagram Sockets (RDS) module to be loaded on the target system, io_ring to be enabled, a readable SUID-root binary, and x86_64 support for the included payload. "PinTheft is a Linux local privilege escalation exploit for an RDS zerocopy double-free that can be turned into a page-cache overwrite through io_uring fixed buffers," Zellic and the V12 security team said. "The bug lived in the RDS zerocopy send path. rds_message_zcopy_from_user() pins user pages one at a time. If a later page faults, the error path drops the pages it already pinned, and later RDS message cleanup drops them again because the scatterlist entries and entry count remain live after the zcopy notifier is cleared. Each failed zerocopy send can steal one reference from the first page." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  Debian, fedora, Kernel, linux, privilege escalation, Qualys, Ubuntu, Vulnerability ⚡ Top Stories This Week Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI and More Packages Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email ⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, WebSocket Skimmers and More Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache Corruption 18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager Backdoor Four OpenClaw Flaws Enable Data Theft, Privilege Escalation, and Persistence Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday [Webinar] How Modern Attack Paths Cross Code, Pipelines, and Cloud ThreatsDay Bulletin: PAN-OS RCE, Mythos cURL Bug, AI Tokenizer Attacks, and 10+ Stories Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege Escalation Load More ▼ ⭐ Featured Resources [Webinar] Learn How to Handle Critical SOC Alerts With AI Support [eBook] Get the 3-Number SOC Diagnostic to Reduce Queue Risk [Guide] Stop Email Fraud Before It Turns Into Ransomware Damage Identify Internal Attack Surfaces More Efficiently With a Free Assessment