Local Linux Shells Become Root on Default Distros

A local shell on a default Debian, Fedora, or Ubuntu system is not a low-level foothold here. This kernel bug turns ordinary user access into root and secret theft, so account containment misses the real blast radius. Qualys says CVE-2026-46333 has existed since November 2016 in __ptrace_may_access(), and the flaw is reliable. It can expose /etc/shadow and SSH host keys, and it has a public proof of concept after last week’s release. That makes any host that allowed untrusted local users during the exposure window a candidate for credential exposure and follow-on access. The risk is not just privilege gain on one machine; it is persistence and lateral movement using stolen host secrets.

Part of the PlainSec briefing for 2026-05-22

Sources