A Poc showing how attackers could abuse the bug on vulnerable kernels. - If an attacker already has a local account or code execution on the machine. - It was already patched and reportedly present…

Steal SSH host private keys and /etc/ shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels.

The AI-assisted turnaround speed from "innocuous github patch commit" to an LPE being up on GitHub is pretty damn fast, now: Interesting times for the kernel

GitHub - 0xdeadbeefnetwork/ssh-keysign-pwn: Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. · GitHub

#slackware included

ssh-keysign-pwn : Read root-owned files as an unprivileged user. Pre-31e62c2ebbfd kernels (everything in stable as of 2026-05-14).

怎么最近动不动就看到这种不亚于核爆的漏洞, 这要是放在几年前妥妥的大新闻... Linux 内核存在一个 0-day 漏洞，允许非特权用户在特定条件下访问原本只有 root 用户才能读取的文件。

Not again......... I'm getting really sick and tired of this runabout of exploits that get public disclosure either before or barely after they're patched so the patches haven't been widely pushed by…