--- title: CVE-2026-46333 (ssh-keysign-pwn) Linux kernel vulnerability mitigations description: Mitigations are available for CVE-2026-46333 (ssh-keysign-pwn), a Linux local information disclosure vulnerability. url: https://canonical.com/blog/ssh-keysign-pwn-linux-vulnerability-fixes-available?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Luci Stanescu](https://canonical.com/blog/author/lucistanescu "More about Luci Stanescu") 19 May 2026 # CVE-2026-46333 (ssh-keysign-pwn) Linux kernel vulnerability mitigations [Security](https://canonical.com/blog/tag/security) [Vulnerabilities](https://canonical.com/blog/tag/vulnerabilities) --- Share the article An information disclosure security vulnerability in the Linux kernel was publicly disclosed on May 15th, 2026. The vulnerability was reported by Qualys and [fixed](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=36d49bba19f2c19c933d13b25dcf4eb607a030b3) in the mainline Linux kernel tree. A proof-of-concept exploit was published soon after public disclosure. The ID [CVE-2026-46333](https://ubuntu.com/security/CVE-2026-46333) was assigned, but the vulnerability is also referred to as “ssh-keysign-pwn”, based on the proof-of-concept exploit. The vulnerability is a race condition that can result in the disclosure of sensitive files to unprivileged local users. The exploit demonstrates this by disclosing the contents of the `/etc/shadow` file (containing hashed local user passwords) and OpenSSH server host private keys (which could facilitate SSH on-path attacks or impact SSH host-based authentication). [CVE-2026-46333](https://ubuntu.com/security/CVE-2026-46333) has been assigned a CVSS 3.1 score of 5.5 by CISA, corresponding to a severity of Medium. Canonical agrees with this assessment. The Ubuntu Priority assigned is High, due to the disclosure of sensitive local information to unprivileged users. Linux kernel package updates are available that fix these vulnerabilities. This blog had been published on the day the vulnerability was publicly disclosed, describing mitigations that disable the  ability to exploit the vulnerability, at a cost of being unable to run debugging tools (such as gdb and gcore) as unprivileged users. The mitigations are no longer necessary if the Linux kernel updates are applied. ## Impact The vulnerability allows disclosure of files opened by a suid or sgid executable to an unprivileged attacker that invokes the suid or sgid executable. The race condition occurs as the privileged process exits, which requires the executable to keep the sensitive files open when exiting. During a short window, an unprivileged attacker can inspect an invoked privileged process using the `ptrace()` system call. The demonstrated exploits include: * The ability to read the contents of the `/etc/shadow` file via the sgid `/usr/bin/chage`. The file contains hashed local user passwords and would require an additional brute-force attack in order to retrieve the plain-text passwords. The [algorithms used by Ubuntu](https://documentation.ubuntu.com/security/security-features/cryptography/password-hashing/#password-hashing) are considered strong against such attacks, but require passwords that conform to current best practices. * The ability to read the OpenSSH server host private keys via the suid `/usr/lib/openssh/ssh-keysign`. These are used by the OpenSSH server to prove its identity to clients and ensure that an [on-path attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) does not compromise SSH connections. Additionally, the OpenSSH host keys are used for [host-based authentication](https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Host-based_Authentication) and their disclosure could lead to user impersonation on deployments that use this uncommon authentication method. On container deployments, the information that can be disclosed is strictly within the confines of the container and, generally, unlikely to be useful to an attacker. ## Affected releases In Ubuntu, the vulnerability fix is distributed through the Linux kernel image packages. Before the Linux kernel security updates were available, this blog post described a mitigation that can be applied in the instructions below. The mitigation will impact debuggers, such as gdb. The mitigation is no longer necessary if the Linux kernel updates are applied. | | | | | --- | --- | --- | | **Release** | **Package Name** | **Fixed Version** | | Trusty Tahr (14.04 LTS) | linux | Not affected | | Xenial Xerus (16.04 LTS) | linux | Not affected | | Bionic Beaver (18.04 LTS) | linux | Not affected | | Focal Fossa (20.04 LTS) | linux | Only 5.15 kernel versions were affected. Fixed version: 5.15.0-181.191~20.04.1 5.4 kernels versions are not affected | | Jammy Jellyfish (22.04 LTS) | linux | Linux 5.15: 5.15.0-181.191 Linux 6.8 (HWE): 6.8.0-124.124~22.04.1 | | Noble Numbat (24.04 LTS) | linux | Linux 6.8: 6.8.0-124.124 Linux 6.17 (HWE): 6.17.0-35.35~24.04.1 | | Questing Quokka (25.10) | linux | 6.17.0-35.35 | | Resolute Raccoon (26.04 LTS) | linux | 7.0.0-22.22 | ## How to check if you are impacted On your system, run the following command to get the version of the currently running kernel and compare the listed version to the corresponding table above. ``` uname -r ``` The list of installed kernel packages can be obtained using the following command: ``` dpkg -l 'linux-image*' | grep ^ii ``` ## Security updates We recommend you upgrade all packages: ``` sudo apt update && sudo apt upgrade ``` If this is not possible and the Linux kernel is installed via a meta package, its update can be targeted directly: ``` sudo apt update dpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install --only-upgrade ``` Once the security updates for the Linux kernel are installed, a reboot is required: ``` sudo reboot ``` The unattended-upgrades feature is enabled by default for Ubuntu 16.04 LTS onwards. This service: * Applies new security updates every 24 hours automatically. * If you have this enabled, the patches above will be automatically applied within 24 hours of being available, but a reboot is still required. ## Manual mitigation Update: Linux kernel security updates that fix the vulnerability are now available. The mitigations described in this section are no longer needed and should only be applied if the Linux kernel cannot be updated. If you have previously configured the mitigations, please follow the instructions in the ‘Disabling the mitigation’ section below. The mitigation disables the ability of unprivileged users to attach to other processes using the `ptrace()` system call. This is generally used by debuggers. The [kernel.yama.ptrace\_scope](https://documentation.ubuntu.com/security/security-features/process-memory/#ptrace-scope) sysctl can be used to restrict the situations in which the affected system call can be used. On Ubuntu, the sysctl parameter defaults to the value `1`, which imposes an ancestor-descendant relationship between the attacker’s process and the victim. The scope can be further restricted with one of the following values: * `2`: this disallows the use of the `ptrace()` system call for users without the `CAP_SYS_PTRACE` privilege, which is the case for most users. As such, an attacker would not normally have this capability,. Debugging tools that utilize ptrace, such as gdb and gcore, will be impacted for unprivileged users. * `3`: this disables attaching to processes using `ptrace()` altogether. Debugging tools that utilize ptrace, such as gdb and gcore, will be impacted for all users, including privileged ones. Please note that if the sysctl is set to the value `3`, it cannot be changed without a system reboot. The following instructions change the currently running value of the `kernel.yama.ptrace_scope` sysctl and configure a drop-in file (`/etc/sysctl.d/99-CVE-2026-46333.conf`) to retain the value across reboots. We consider setting the to the value 2 to be a sufficient mitigation. If you wish to use the value `3`, you can adjust the command accordingly. ``` echo kernel.yama.ptrace_scope=2 | sudo tee /etc/sysctl.d/99-CVE-2026-46333.conf sudo sysctl -p /etc/sysctl.d/99-CVE-2026-46333.conf ``` ## Disabling the mitigation Once kernel updates are installed, the mitigation can be removed: ``` sudo rm /etc/sysctl.d/99-CVE-2026-46333.conf sudo sysctl kernel.yama.ptrace_scope=1 ``` We recommend you do not set this parameter to the value `0`, as doing so would disable the protections provided by the feature, as explained [here](https://documentation.ubuntu.com/security/common-mistakes/dangerous-sysctls/#kernel-yama-ptrace-scope). [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### DirtyClone Linux kernel local privilege escalation vulnerability fixes available](https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available) On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### pedit COW kernel local privilege escalation vulnerability mitigations](https://canonical.com/blog/pedit-cow-linux-vulnerability-fixes-available) Mitigations are available for the Linux vulnerability with CVE ID CVE-2026-46331. The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE)... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### PinTheft Linux kernel vulnerability mitigation](https://canonical.com/blog/pintheft-linux-kernel-vulnerability-mitigation) A local privilege escalation (LPE) security vulnerability in the Linux kernel, codename “PinTheft,” was publicly disclosed on May 19, 2026. The vulnerability was fixed in the... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 21 May 2026