Skip to content

linux 0-day, access root-owned files as an unprivileged user

7.7 relevance
Score Breakdown
technical depth
8
novelty
9
actionability
8
community
7
strategic
6
personal
6

Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.

Critical 0-day exploit with high technical detail and immediate actionability for patching.

2026-05-15 general Lobsters
Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn
Summary

A Linux 0-day, reported by Qualys and fixed by Linus on 2026-05-14, lets unprivileged users read root-owned files via a race in do_exit() where __ptrace_may_access() skips the dumpable check when task->mm is NULL, allowing pidfd_getfd(2) to steal file descriptors. Two PoCs (sshkeysign_pwn and chage_pwn) extract SSH host keys and /etc/shadow, exploiting a six-year-old FD-theft pattern flagged by Jann Horn. The bug affects all stable kernels before commit 31e62c2ebbfd, confirmed on Debian, Ubuntu, Arch, CentOS, and Raspberry Pi OS.

Key Takeaway

Patch all stable Linux kernels to commit 31e62c2ebbfd to close the pidfd_getfd race window that allows unprivileged users to read root-owned files.

Why it matters

For a senior engineer managing Linux infrastructure, this vulnerability undermines file permission isolation and requires immediate patching to prevent credential theft from SSH host keys and shadow files.