Vulnerabilities & Exploits · Zero-Day Exploit

Default Linux Installs Exposed to Public Root Exploits

A patch-only view misses the blast radius here: a decade-old ptrace flaw gives any local user on affected Linux systems a path to root and to sensitive credentials, and the problem sits in default installs of several major distributions. The old assumption was that Linux LPEs hide behind odd configs or optional modules. That no longer holds for CVE-2026-46333.

Qualys says the bug lives in __ptrace_may_access() and has been in mainline since November 2016. It published the full advisory, confirmed working exploits are circulating in public, and says upstream patches and distribution updates are available. The impact includes root execution and disclosure of files such as /etc/shadow and host SSH keys on tested default builds of Debian, Ubuntu, and Fedora releases.

For defenders, the risk is not just privilege gain. Any multi-user host that allows untrusted local code can also leak privileged file descriptors and authenticated inter-process channels, which keeps exposure alive even after the kernel is patched.

4 sources · May 20

CVE-2026-46333

NVD KEV

CVSS 7.1 HIGH: in the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic… EPSS 2% (72nd percentile). Microsoft patch: CBL-Mariner Releases.

Timeline

Sources

Part of the PlainSec briefing for 2026-05-19

Every edition of this story: Default Linux Installs Exposed to Public Root Exploits

More from today