Local increase in Linux privileges via CVE-2026-46333: ptrace race condition from stilt to root

[Depov]

In May 2026, Qualys Threat Research Unitrevealed CVE-2026-46333- logical error in __ptrace_may_access()Linux kernel. Bag lived in a mainline code for nine years, startingwith v4.10-rc1 (November 2016). Four working exploits - againstDefault installations Debian 13, Ubuntu 24.04/26.04, Fedora 43 and44. Unprecedented local user could read /etc/shadow,stealing SSH host private keys or getting root-haul via hijack D-Busconnections to systemd. Public PoCs appeared almost immediately afterdisclosure: according to CISA-ADP, the technical impact - total, thestatus of operation - poc. The wave of nuclear LPE-vulnerabilities ofMay 2026 was not limited to one CVE: in addition to CVE-2026-46333Revealed by PinTheft, DirtyClone (CVE-2026-43503,CVSS 8.8, CWE-664) and pedit COW (CVE-2026-46331,CWE-190/CWE-787). CVE-2026-31431(not to be confused with CVE-2026-46333)with which CVE-2026-46333united in a chain of operation, relevantlyoperated and entered in CISA KEV(patinkade - 2026-05-15; short description: "Linux KernelIncorrect Resource Transfer Between Spheres Vulnerability").

Thesituation is standard: you are already on the server. Received Shellfrom www-datathrough the RCE in the web application, I went to the SSH withhijacked low-priv credentials or hit the host through a compromisedCI-runner. Between you and complete control is the barrier of theprivileges of the nucleus. And here the most interesting thingbegins.

By MITRE ATT&CK, the operation of SUID /SGID-binary - this T1548.001(Setuid and Setgid, tactic Privilege Escalation). In contrast tothe classic GNU/Linux privesc technician - misconfigured sudo,writable cron (T1053.003),capabilities with cap_setuid- there is no need for misconfiguration on the target system. Thevulnerability sits in the core itself. Default configuration of thedistribution is a sufficient condition for operation. No sudoerscurves, no forgotten cron scripts. Just a bug nucleus that no onenoticed for nine years.

Financial impact: on sharedhosting or in multitenant environments, there is one compromisedaccounting - the path to the root on the entire host. Stolen SSH hostkeys open on-path attacks on SSH connections, and hasheishes/etc/shadow- offline-bbutforth of passwords.

[Applicable: internalpentest, post-exploitation on Linux hosts, grey box withlow-priv-crementials]

Anatomy CVE-2026-46333:logical error of the dumpable-checking in the ptrace Linux kernel​

ByNVD, CVSS 3.1 score - 7.1 (HIGH);vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.Let's look at the components: AV:L- only local access; AC:L- low complexity (race condition reproduces stable); PR:L- need any unprivileged user; C:H/I:H- complete compromising confidentiality and integrity; A:NAccessibility is not affected. More details - in our LinuxPentester Manual.

Classification: CWE-269(Improper Privilege Management).Vulnerable branches on OSV.dev: 4.10.0-5.10.255,5.11.0–5.15.206andalso 5.16.0+(check your branch on OSV.dev). Red Hat has confirmed thevulnerability for the RHEL 8, 9, 10 and OpenShift Container Platform4.

Mechanics: race window at do_exit() and pidfd_getfd()​

Function __ptrace_may_access() usesthe dumpable flag to determine whether it is possible to join someoneelse’s process via ptrace. The flag is conceptually tied to thepresence of a memory map (mm) And theproblem is the logical error of the jobment checking in the transientcondition tearing (official CWE-269, Improper Privilege Management;operation has a race-like nature, but the root cause is incorrectlogic get_dumpable() with mm== NULL) It occurs at the end of the privilegedprocess.

Consistency of events in do_exit()Privileged SUID-binary:

2. The process (e.g., ssh-keysign) performs work with increased privileges, opens /etc/ssh/*_key
   
3. The process causes exit(), the core starts teardown
   
4. exit_mm()releases memory map - pointer mmbecomes NULL
   
5. File descriptors and IPC connections are still open - here it is, the race window
   
6. Only then the kernel closes the open file descriptors

Between steps 3 and 4 is the most delicious. Function__ptrace_may_access() sees mm== NULL and misses the branch if (mm &&…) - dumpable checking is not performed. With Defaultptrace_scope=1 YAMA LSM allowsparent→child access. Under normal conditions ptrace_may_access()would still block access to the SUID-process due to the dumpeddumpable flag, but after exit_mm() Thischeck does not work - both barriers are removed at the same time. Theattacker calls pidfd_getfd() (syscalladded to v5.6-rc1, January 2020) and copies the open file descriptorsof the preferred process.

Key point: for SUID-binaryptrace_may_access() usually block accessdue to the change of eid and the dumping of the dumping-wave, butafter exit_mm() the handleable check ispassed (mm ==NULL) and YAMA ptrace_scope=1Allows parent->child access. Two barriers fall at the sametime.

Upstream fix - cache the latest state of dumpabilityfor processes with mm=NULL and the CAP_SYS_PTRACE requirement toaccess such processes.

When ptrace Linux Vulnerability Doesn't Work​

Technique Blocked if:

• kernel.yama.ptrace_scopeequal to 2 (only CAP_SYS_PTRACE) or 3 (full-restriction). YAMA LSM rejects pydfd_getfd() for unvited users
  
• The core is updated until 5.10.256+ or 5.15.207+
  
• There are no SUID/SGIDbinary on the host with access to sensitive files (not likely to default installations - this happens only on hardened containers)
  
• The nucleus is older v5.6 - syscall piddfd_getfd() is missing; PoC-primitive is not available, although the nuclei of 4.10–5.5 contain vulnerable code
  
• Container environments: Canonical, the leak is limited to container and "generally to be be useful to an attacker"

Four vectors of operation CVE-2026-46333​

Adjustmentsto the environment​

• OS: Linux with kernel 4.10 - 5.15.206 (not including patched branches)
  
• Privileges: any unprivileged user
  
• ptrace_scope: default value 1 (check: sysctl kernel.yama.ptrace_scope)
  
• piddd_getfd: kernel 5.6+ (there are in most distributions since 2020)
  
• SUID/SGID binarys: /usr/bin/chage, /usr/lib/openssh/ssh-keysign, /usr/bin/pkexec
  
• RAM: from 512 MB (openwork is undemanding)
  
• Network: not required (completely local attack)

Bash:

uname -r
sysctl kernel.yama.ptrace_scope
find / -type f \( -perm -4000 -o -perm -2000 \) 2>/dev/null | head -20 SUID/SGID

Leakedcredentials: /etc/shadow and SSH host keys​

chage -- /etc/shadow. Debian/Ubuntu chageDefault is with set-gid-shalow. Call chage -lroot - she opens /etc/shadow,then it ends. In the window between exit_mm()and the closure of descriptors attacking through pidfd_getfd()intercepts the FD and reads the contents - the hash of passwords ofall local users. Canonical stipulates that Ubuntu hashing algorithms(SHA-512/yescrypt) resistant to offline-brutfrosso with strongpasswords. But "strong passwords" on shared hosting is morean exception than a rule. The vulnerability is reproduced on moderndistributions with nuclei 4.10-5.5.206.

SH-keysign --SSH host private keys. SUID-binary /usr/lib/openssh/ssh-keysignat launch opens /etc/ssh/*_key. Theattacker intercepts the descriptor - and here it has private hostkeys. Impact: on-path attack (MitM) on SSH connections, compromisinghost-based authentication. Public PoC-repository KaraZajac/CHARONcontains pre-built exploit: generates a child process, opens thepidfd and repeatedly scans file descriptors through pidfd_getfd(),checking each duplicited descriptor with the target file through/proc/self/fd/<n>.

ppexec and-daemon: arbitrary code from root​

Two advanced vectors do not give you to read files, but a fullexecution of commands from root. It's not just a leak here anymore,it's a complete grip.

Pkexec (set-uid-root): Theattacker intercepts the authenticated D-Bus connection to thesystemd. Prediction - availability allow_activesessions on the console that works even with a remote SSH connection,if someone is logged locally. Applicable to distributions with nuclei4.10-5.15.206 and default ptrace_scope=1.

/-daemon(root daemon): the exploit is looking for PID accounts-daemon through/proc, triggerite activity throughbusctl and AccountsService, then theracing streams evoke pidfd_getfd() fortheft of the D-Bus socket. Through the stolen socket, handcraftedD-Bus messages are sent: SetShell, SetAccountType (admin),SetPassword with controlled hash. The result - the current userreceives administrative rights. It's beautiful, to be honest.Applicable to distributions with vulnerable nuclei and defaultptrace_scope=1.

PoC analysis: how the local Linux exploit works​

Thepublic repository KaraZajac/CHARON (GitHub, updated 2026-05-21, 6stars) contains pre-built PoC for CVE-2026-46333 (Linux ptracemm==NULL fd theft). Algorithm of work:

2. The attacker evokes the target SUID/SGID-binary as a child process, redirecting stdout/stderr to /dev/null
   
3. Immediately opens pidfd via syscal pidfd_open()
   
4. In the cycle (hundreds of iterations, dozens of rounds) causes pidfd_getfd(pidfd, target_fd, 0)for file descriptors range (3-63 for ssh-keysign, 3-499 for research versions)
   
5. Most of the calls are returned -EPERM- the process is alive, the dumpable-check is working normally
   
6. When the child process is included in the do_exit()and exit_mm()resets mm, pidfd_getfd() passes - the descriptor duplicates
   
7. The attacker checks the way through /proc/self/fd/<n>, when matched with the target file - reads the content

Advanced PoC implementations increase the number of iterations andthe range of scanned descriptors to increase reliability.

PrimitiveStable: The Window Between exit_mm() andclosing the FD is quite wide for multiple probe attempts. AC:L inCVSS vector is not for beauty, race is really played from the firstattempts.

EPSS - 0.9627 (percentage 99.87, Top 1%),extremely high probability of operation. CISA-APD SSVC decision: Act- put it right now.

 

[Akladia]

ok