Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels.
Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels.
"It is a fearful thing to fall into the hands of the living God." — Hebrews 10:31
Read root-owned files as an unprivileged user. Pre-31e62c2ebbfd kernels (everything in stable as of 2026-05-14).
__ptrace_may_access() skips the dumpable check when task->mm == NULL. do_exit() runs exit_mm() before exit_files() — no mm, fds still there. pidfd_getfd(2) succeeds in that window when the caller's uid matches the target's.
Reported by Qualys, fixed by Linus 2026-05-14. Jann Horn flagged the FD-theft shape in October 2020. Six years.
sshkeysign_pwn — pulls /etc/ssh/ssh_host_{ecdsa,ed25519,rsa}_key. ssh-keysign.c opens them (mode 0600) before permanently_set_uid(), then bails on EnableSSHKeysign=no with the fds still open. Same shape since 2002.
chage_pwn — pulls /etc/shadow. chage -l calls spw_open(O_RDONLY) then setreuid(ruid, ruid). Both args set means uid=euid=suid=ruid: full drop. Race the exit, lift the shadow fd, crack the root hash offline.
make
./sshkeysign_pwn # host keys
./chage_pwn root # /etc/shadow contentEither prints the file on stdout. Hits in 100–2000 spawns.
Raspberry Pi OS Bookworm 6.12.75, Debian 13, Ubuntu 22.04 / 24.04 / 26.04, Arch, CentOS 9.
vuln_target.c opens /etc/shadow then drops. exploit_vuln_target.c shows EPERM while it's alive and the steal post-SIGKILL.
sudo install -m 4755 vuln_target /usr/local/bin/vuln_target
./exploit_vuln_target /usr/local/bin/vuln_targethttps://nvd.nist.gov/vuln/detail/CVE-2026-46333No open issues yet, or sync has not completed.