CVE-2026-46333: Local Root Privilege Escalation and Credential Disclosure in the Linux Kernel ptrace Path | Qualys

Summary: Qualys' Threat Research Unit disclosed CVE-2026-46333, a logic flaw in the Linux kernel's __ptrace_may_access() function that lets an unprivileged local user read sensitive files and run commands as root on default installations of several major distributions; the bug has been in mainline Linux since v4.10-rc1 in November 2016. Qualys built four working exploits against chage, ssh-keysign, pkexec, and accounts-daemon, reported the flaw privately on 2026-05-11, and the patch was committed publicly on 2026-05-14, with an independent exploit appearing shortly after.
Key Takeaway: Any unprivileged shell on a vulnerable host is enough to read /etc/shadow, exfiltrate SSH host private keys, or execute arbitrary commands as root through hijacked dbus connections to systemd - so a phished developer account, a constrained CI runner, or a shared multi-tenant host becomes a direct path to root. The vulnerable code has shipped since November 2016, spanning nine years of enterprise fleets, cloud images, and container hosts.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-46333
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026