Your host keys are readable
CVE-2026-46333, known as ssh-keysign-pwn, is a race in the Linux kernel process-exit path that lets an unprivileged local user capture open file descriptors from an exiting setuid process, including SSH host private keys and /etc/shadow. Patch the kernel; until then, raising kernel.yama.ptrace_scope closes the window. Red Hat tracks it as RHSB-2026-004.
A local user can read your SSH host keys. Default install, no root needed.
Host keys and the shadow file are root-owned. The assumption is that an ordinary account simply cannot reach them.
A flaw in the kernel process-exit path broke that assumption. When a privileged program exits, there is a brief window where its still-open files can be captured by an unprivileged process watching it.
One of those programs ships with openssh and runs setuid. Through it, a normal user reaches the host private keys and the shadow file.
It was fixed in May. It had been there for about nine years, on default Debian, Fedora and Ubuntu.
The kernel update is the real fix. Where you cannot patch yet, raising the ptrace scope closes the window, and the value survives a reboot from a file like this one.
Patch the kernel. Until then, raise ptrace scope.
#linux#security#ssh#infosec#sysadmin
❯ Patch the kernel. Until then, raise ptrace scope.