A logic flaw sitting quietly in the Linux kernel since at least 2020 — possibly longer — just got a working exploit, a public proof-of-concept, and a same-day patch from Linus Torvalds.
The vulnerability, dubbed ssh-keysign-pwn, was disclosed by Qualys on May 14, 2026, and patched by Linus Torvald the same day. The damage it could have done — and in unpatched environments still can — is significant: any unprivileged local user can silently read a server's SSH host private keys or the entire /etc/shadow file containing hashed user passwords.
The bug lives in __ptrace_may_access(), the kernel's gatekeeper for deciding whether one process can inspect another. The function skips its "dumpable" check when task->mm == NULL — a state that occurs briefly during process exit, after memory is released (exit_mm()) but before file descriptors are closed (exit_files()). That tiny window is everything.
An attacker uses pidfd_getfd(2) — a legitimate Linux syscall introduced in kernel 5.6 — to steal open file descriptors from a dying privileged process during that gap, when the caller's UID matches the target's. No root required. No special permissions needed.
Two ready-to-run exploits ship with the public PoC: sshkeysign_pwn targets the ssh-keysign utility, which opens sensitive host key files before dropping root privileges. By racing the process exit, an unprivileged user can lift those file descriptors. chage_pwn attacks the chage utility to pull /etc/shadow, enabling offline cracking of password hashes. The exploit reliably hits within 100–2,000 process spawns.
Six Years of Missed Warnings
Google security researcher Jann Horn had already proposed a patch for the underlying FD-theft behavior back in October 2020 — but it never made it through. The ssh-keysign fd-leaving pattern itself dates to 2002. chage's vulnerable spw_open + setreuid shape is similarly ancient. The flaw was there. The patch proposal existed. Nobody pushed it across the finish line for five years.
Who Is Affected
All stable Linux kernels as of May 14, 2026, are affected — everything before commit 31e62c2ebbfd. Confirmed vulnerable distributions include Arch Linux, Debian, Ubuntu, CentOS, and Raspberry Pi OS. If you run any mainstream Linux server or desktop and haven't applied yesterday's kernel update, your SSH host keys and shadow file are readable by any local user on the box.
The fix is in the mainline kernel as of May 14. Until you patch, a temporary workaround is removing execute permissions from ssh-keysign and chage — though this doesn't fix the underlying issue and may break legitimate functionality.
- Update your kernel immediately and reboot — this is the only real fix
- Rotate all SSH host keys on any system that may have been exposed
- Force a password reset for privileged accounts if
/etc/shadowwas accessible - Run
uname -rto confirm your running kernel includes commit 31e62c2ebbfd
The patch adjusts the kernel's ptrace behavior to properly handle the mm == NULL case. Linus described the new logic as "slightly saner" — an understated note for a bug that spent six years one race condition away from becoming a full server compromise.