A new critical vulnerability that has existed for ten years has been identified in Linux.

Critical vulnerability discovered in Linux kernel

A serious bug has been identified inside the Linux kernel code that allows any user to gain root access to the system. The vulnerability is present in all kernel versions since 2016 and affects the most popular distributions: Red Hat, SUSE, Debian, Fedora, AlmaLinux, and CloudLinux.

What an attacker can do
* Read closed files.
* Execute commands as superuser.
* Copy open connections and program files before they terminate.

The vulnerability is identified as CVE‑2026‑46333 and has been rated a threat level of 5.5 out of 10 (average risk). When operating with administrator privileges, Linux should immediately block other processes from accessing a terminating program. The bug causes a delay of less than a second, giving unprivileged users an opportunity to exploit this “window” for reading and execution.

Exploits and confirmation
Qualys specialists discovered the issue and created four working exploits. Their effectiveness was proven on the following distributions:
* Debian 13
* Ubuntu 24.04 / 26.04
* Fedora 43 and 44

The exploits were disclosed confidentially to the Linux kernel on May 11, 2026, and an official patch was released three days later on May 14. However, shortly after the release, an independent exploit using a public commit appeared, breaking the embargo and forcing developers to disclose details of the vulnerability.

How to protect yourself
1. Update the kernel as soon as possible – this is the most reliable way to eliminate the problem.
2. If updating is not possible, set `kernel.yama.ptrace_scope=2`. This blocks most public exploits.
3. On systems where untrusted local users were present at the time of exploitation, treat SSH keys and cached credentials as compromised – replace them immediately.

Conclusion
Vulnerability CVE‑2026‑46333 opens a path to root access through a brief window between process termination and access blocking. Prompt kernel updates and temporary protective measures can help avoid potential attacks.