Disclosure of sensitive information affecting the Linux kernel
A vulnerability affecting the Linux kernel would allow an authenticated attacker to read sensitive files on affected systems.
Description
Technical context and vulnerability details
The Linux kernel is the central component of the Linux operating system, which orchestrates communication between hardware and software and allows resource management to ensure system stability and security. This component is affected by a vulnerability labeled CVE-2026-46333 resulting from a logical flaw in the inter-process access control mechanism. This weakness creates a short exploitable window when shutting down a privileged process. Exploitation of this vulnerability would allow an unprivileged local user to bypass system protections and access sensitive files, including the SSH server private keys and the /etc/shadow file containing password hashes. It is classified high with a severity score of 7.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Privilege escalation;
Affected systems
Products, components and targeted versions
- Linux kernel versions 5.6 and later, prior to patched stable versions 5.10.256, 5.15.207, 6.1.173, 6.6.139, 6.12.89, 6.18.31 and 7.0.8;
RECOMMENDED ACTIONS:
- Update the Linux kernel to its latest stable version;
Sources & External Links
Vendor security advisories and documentation
- https://nvd.nist.gov/vuln/detail/CVE-2026-46333
- https://github.com/torvalds/linux/commit/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a
- https://www.openwall.com/lists/oss-security/2026/05/15/2
- https://access.redhat.com/security/cve/cve-2026-46333
- https://almalinux.org/blog/2026-05-15-ssh-keysign-pwn-cve-2026-46333/
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.