A critical vulnerability in the Linux kernel, tracked as CVE-2026-46333, has been found to have existed for nearly nine years. The flaw stems from improper privilege management in the __ptrace_may_access() function, introduced in November 2016. It allows unprivileged local users to escalate privileges and execute arbitrary commands as root on default installations of major distributions including Debian, Fedora, and Ubuntu.

Cybersecurity firm Qualys, which discovered the issue, warns that the vulnerability enables attackers to access sensitive system files such as /etc/shadow and private SSH keys stored under /etc/ssh. Exploitation can occur through multiple attack vectors involving chage, ssh-keysign, pkexec, and accounts-daemon. A proof-of-concept exploit was published shortly after a public kernel commit revealed changes addressing the flaw.

Administrators are urged to apply the latest kernel updates immediately. Where immediate patching isn't possible, raising the kernel.yama.ptrace_scope value to 2 offers temporary mitigation. Systems that allowed untrusted local access during the exposure window should assume SSH host keys and cached credentials are compromised and rotate them accordingly.