If you’re keeping a tally at home, this is the fourth local-root Linux kernel disclosure we have written about in roughly two weeks. At this rate the AlmaLinux build servers and core team are going to start getting hazard pay.
The new flaw is tracked as CVE-2026-46333, and is being called ssh-keysign-pwn after one of the two public exploits. Qualys reported the underlying bug to [email protected] and Linus pushed the fix on 2026-05-14 in commit 31e62c2ebbfd. Hours later, “_SiCk” published two working exploits: one that reads /etc/ssh/ssh_host_*_key (via ssh-keysign), and one that reads /etc/shadow (via chage -l).