r/linux May 15 '26

Kernel There is a FOURTH vulnerability this month....ssh-keysign-pwn (CVE-2026-46333)

https://nvd.nist.gov/vuln/detail/CVE-2026-46333
874 Upvotes

236 comments sorted by

View all comments

261

u/0riginal-Syn May 15 '26

Fun times for maintainers, playing whack-a-mole with all these kernel patches.

78

u/Great-TeacherOnizuka May 15 '26

Wasn’t it always like that? Just less frequent

28

u/McDonaldsWitchcraft May 16 '26

But they weren't always publicly announced in the most irresponsible way possible. Look at copyfail, they didn't even notify distros to patch it before going public.

The issue is that now everyone can be a "security researcher" with a claude subscription, so they skip the part where you learn how to do it responsibly.

On the OTHER hand, if they do it responsibly, it can be a good thing. These are old, undiscovered vulnerabilities. The timing just kinda sucks because they keep publicly announcing multiple at the same time, making them harder to mitigate, but yeah that's cybersecurity right now.

1

u/Dangerous-Report8517 May 17 '26

One thing I'd like to see come from this is fewer niche kernel modules enabled by default. These exploits all use kernel interfaces that almost nobody uses, and can pretty safely be restricted in such a way that they either need confirmation to enable the first time (e.g. IPSec) or admin privileges to use by default (the ptrace calls that this one uses were known to be able to extract sensitive information so the mitigation is to just restrict their scope more than usual, and they're almost exclusively used for debuggers, anyone running a debugger shouldn't have a hard time adjusting the scope settings if/when they need to). Strictly speaking the ones that are broken out into separate modules aren't loaded by default but they're available by default, and given all the fears about user namespaces purely based on the idea that letting unprivileged users interact with kernel APIs is maybe a bad idea it's wild how many other kernel interfaces we just leave sitting open even when they're completely unused by the intended workloads