A critical logic bug (CVE-2026-46333) was discovered in the Linux kernel's __ptrace_may_access() function, allowing local privilege escalation and information disclosure. The vulnerability, present since Linux 4.10-rc1 (2016), enables attackers to bypass security checks and execute arbitrary commands as root. Multiple proof-of-concept exploits have been demonstrated against common system utilities including chage, ssh-keysign, and pkexec across major Linux distributions.
Background
The __ptrace_may_access() function is a critical security component in the Linux kernel that controls access permissions for process tracing and debugging operations. It was modified in 2016 to better handle user namespace permissions, but the change introduced a logic flaw that could be exploited to bypass security checks.
- Source
- Lobsters
- Published
- May 21, 2026 at 03:04 AM
- Score
- 9.0 / 10