F5OS / Traffix SDC Information Disclosure (CVE-2026-46333) — Linux Kernel ptrace/pidfd_getfd Race Condition, Public PoC (CHARON) — Threadlinqs Intelligence
As of 2026-07-18, F5OS / Traffix SDC Information Disclosure (CVE-2026-46333) — Linux Kernel ptrace/pidfd_getfd Race Condition, Public PoC (CHARON) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-1503 · Severity: HIGH · CVSS: 7.1 · Status: ACTIVE · Category: VULNERABILITY
GovCERT.HK issued a High Threat alert (A26-07-23) for CVE-2026-46333 affecting F5OS 2.0.0 and Traffix SDC 5.2.0, with public PoC exploit code available. Every authoritative technical source for this
GovCERT.HK's High Threat Security Alert A26-07-23 (published 2026-07-15) states that PoC exploit code is publicly available for an information-disclosure vulnerability affecting F5OS version 2.0.0 and Traffix SDC version 5.2.0, citing CVE-2026-46333 and F5 Knowledge Article K000162205 as the vendor reference; the F5 KB article itself could not be fetched directly (client-side loading error on two attempts), so downstream analysis relies on the CVE's independently-corroborated technical record, which is extensive and consistent across every authoritative source checked (NVD, CVE.org, Red Hat, Ubuntu, SUSE, Debian, AlmaLinux, Qualys).
CVE-2026-46333 is a nine-year-old logic flaw in the Linux kernel's ptrace subsystem, publicly disclosed and fixed in May 2026 by Qualys' Threat Research Unit. The root cause lies in __ptrace_may_access(), which short-circuits its dumpability check whenever task->mm == NULL. During process exit, the kernel's do_exit() calls exit_mm() before exit_files(), so for a brief window a dying privileged (often SUID-root) process has mm cleared but its file descriptor table still populated and still reachable. An unprivileged local attacker with the same UID as the dying process can race this window using the pidfd_getfd(2) syscall (introduced in Linux 5.6) to duplicate an open file descriptor out of the privileged process before it fully exits — sidestepping normal ptrace access controls entirely. F5's F5OS 2.0.0 and Traffix SDC 5.2.0 platforms run a Linux kernel within the affected version range, which is why GovCERT.HK's alert maps this generic Linux kernel CVE onto those specific F5 appliance products.
Qualys operationalized this into four working exploit chains using common SUID/SGID or root-daemon binaries as unwitting 'lures': chage or passwd (both open /etc/shadow) to disclose the shadow password database; ssh-keysign (SUID-root) to steal SSH host private keys, enabling host impersonation and lateral movement; pkexec, hijacked via its D-Bus connection, to execute arbitrary commands as root; and accounts-daemon, abused similarly, to gain root code execution. A public, dependency-free PoC named CHARON (github.com/KaraZajac/CHARON) automates the /etc/shadow and SSH host-key theft path with a reported sub-one-second success rate on a 4-core VM (~137 attempts average), and a second public PoC (ssh-keysign-pwn) targets the SSH host-key theft path specifically. At least 32 public PoC/exploit repositories reference this CVE — consistent with GovCERT.HK's statement that PoC code is publicly available for the F5-hosted instances of this kernel.
Affected kernel versions span from v4.10-rc1 (November 2016) through pre-patch releases up to 6.12.89/6.15-rc1 depending on distribution branch; essentially every mainstream Linux distribution shipping a kernel in that range is affected, including Debian 13, Ubuntu 22.04/24.04/26.04, Fedora 43/44, RHEL, SUSE, AlmaLinux, CloudLinux, and — per GovCERT.HK — F5's Linux-based appliance platforms F5OS 2.0.0 and Traffix SDC 5.2.0. Disclosure ran through Qualys reporting privately to the upstream kernel security contact on 2026-05-11, a public patch commit (31e62c2ebbfd, "ptrace: slightly saner get_dumpable() logic") and CVE assignment on 2026-05-14, public oss-security disclosure on 2026-05-15, and a full Qualys technical writeup on 2026-05-22, ahead of GovCERT.HK's downstream F5-specific alert two months later on 2026-07-15.
The primary interim mitigation, absent an immediate patch, is raising kernel.yama.ptrace_scope to 2 (admin-only ptrace attach), which blocks pidfd_getfd()'s reliance on __ptrace_may_access() — at the operational cost of breaking standard debugging tooling (gdb, strace, perf), browser crash reporters, and container debug/checkpoint workflows (CRIU, kdump). The durable fix is the upstream kernel patch and vendor-supplied updated kernel builds, which F5 states it has shipped for F5OS and Traffix SDC per K000162205.
Weaknesses (CWE)
CWE-269, CWE-362
Target sectors: telecoms, technology, government administration, finance, health, critical-infrastructure
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-46333, T1068, T1548, T1548, T1211, T1552, T1552, T1003, T1082, T1057, T1083