Skip to content

linux 0-day, access root-owned files as an unprivileged user

7.7 relevance
Score Breakdown
technical depth
8
novelty
9
actionability
8
community
7
strategic
6
personal
6

Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.

Critical 0-day exploit with high technical detail and immediate actionability for patching.

General github.com
Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn
Summary

A Linux 0-day, reported by Qualys and fixed by Linus on 2026-05-14, lets unprivileged users read root-owned files via a race in do_exit() where __ptrace_may_access() skips the dumpable check when task->mm is NULL, allowing pidfd_getfd(2) to steal file descriptors. Two PoCs (sshkeysign_pwn and chage_pwn) extract SSH host keys and /etc/shadow, exploiting a six-year-old FD-theft pattern flagged by Jann Horn. The bug affects all stable kernels before commit 31e62c2ebbfd, confirmed on Debian, Ubuntu, Arch, CentOS, and Raspberry Pi OS.