ssh-keysign-pwn (CVE-2026-46333): Patched kernels available in testing (opens in new tab)

If you’re keeping a tally at home, this is the fourth local-root Linux kernel disclosure we have written about in roughly two weeks. At this rate the AlmaLinux build servers and core team are going to start getting hazard pay. The new flaw is tracked as CVE-2026-46333, and is being called ssh-keysign-pwn after one of the two public exploits. Qualys reported the underlying bug to security@kernel.org and Linus pushed the fix on 2026-05-14 in commit 31e62c2ebbfd. Hours later, “_SiCk” published t...