F5OS / Traffix SDC Information Disclosure (CVE-2026-46333) — Linux Kernel ptrace/pidfd_getfd Race Condition, Public PoC (CHARON)
F5OS / Traffix SDC Information Disclosure (CVE-2026-46333) (TL-2026-1503), also tracked as CHARON, is a high-severity software vulnerability scored CVSS 7.1, first published 2026-07-18. It has no confirmed attribution, affects F5 F5OS, references 1 CVE (CVE-2026-46333), maps to 13 MITRE ATT&CK techniques (T1003, T1005, T1021), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-1503
- Threat ID
- TL-2026-1503
- Also known as
- CHARON, ptrace mm==NULL fd theft, ssh-keysign-pwn, A26-07-23
- Severity
- HIGH
- CVSS
- 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-18
- Last reviewed
- 2026-07-18
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- telecoms, technology, government administration, finance, health, critical-infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in F5OS / Traffix SDC Information Disclosure (CVE-2026-46333)
Malware and tooling: CHARON, ssh-keysign-pwn
GovCERT.HK issued a High Threat alert (A26-07-23) for CVE-2026-46333 affecting F5OS 2.0.0 and Traffix SDC 5.2.0, with public PoC exploit code available. Every authoritative technical source for this CVE ID (NVD, CVE.org, Red Hat, Ubuntu, SUSE, Debian, AlmaLinux, Qualys) describes it as a Linux kernel race condition in __ptrace_may_access()/get_dumpable() that lets an unprivileged local user abuse pidfd_getfd(2) during a privileged SUID process's exit to steal its open file descriptors — disclosing /etc/shadow and SSH host private keys, and enabling root command execution via pkexec/accounts-daemon. F5's affected appliance platforms (F5OS, Traffix SDC) bundle this vulnerable Linux kernel; F5 has released patched builds per K000162205.
How F5OS / Traffix SDC Information Disclosure (CVE-2026-46333) works
GovCERT.HK's High Threat Security Alert A26-07-23 (published 2026-07-15) states that PoC exploit code is publicly available for an information-disclosure vulnerability affecting F5OS version 2.0.0 and Traffix SDC version 5.2.0, citing CVE-2026-46333 and F5 Knowledge Article K000162205 as the vendor reference; the F5 KB article itself could not be fetched directly (client-side loading error on two attempts), so downstream analysis relies on the CVE's independently-corroborated technical record, which is extensive and consistent across every authoritative source checked (NVD, CVE.org, Red Hat, Ubuntu, SUSE, Debian, AlmaLinux, Qualys).
CVE-2026-46333 is a nine-year-old logic flaw in the Linux kernel's ptrace subsystem, publicly disclosed and fixed in May 2026 by Qualys' Threat Research Unit. The root cause lies in __ptrace_may_access(), which short-circuits its dumpability check whenever task->mm == NULL. During process exit, the kernel's do_exit() calls exit_mm() before exit_files(), so for a brief window a dying privileged (often SUID-root) process has mm cleared but its file descriptor table still populated and still reachable. An unprivileged local attacker with the same UID as the dying process can race this window using the pidfd_getfd(2) syscall (introduced in Linux 5.6) to duplicate an open file descriptor out of the privileged process before it fully exits — sidestepping normal ptrace access controls entirely. F5's F5OS 2.0.0 and Traffix SDC 5.2.0 platforms run a Linux kernel within the affected version range, which is why GovCERT.HK's alert maps this generic Linux kernel CVE onto those specific F5 appliance products.
Qualys operationalized this into four working exploit chains using common SUID/SGID or root-daemon binaries as unwitting 'lures': chage or passwd (both open /etc/shadow) to disclose the shadow password database; ssh-keysign (SUID-root) to steal SSH host private keys, enabling host impersonation and lateral movement; pkexec, hijacked via its D-Bus connection, to execute arbitrary commands as root; and accounts-daemon, abused similarly, to gain root code execution. A public, dependency-free PoC named CHARON (github.com/KaraZajac/CHARON) automates the /etc/shadow and SSH host-key theft path with a reported sub-one-second success rate on a 4-core VM (~137 attempts average), and a second public PoC (ssh-keysign-pwn) targets the SSH host-key theft path specifically. At least 32 public PoC/exploit repositories reference this CVE — consistent with GovCERT.HK's statement that PoC code is publicly available for the F5-hosted instances of this kernel.
Affected kernel versions span from v4.10-rc1 (November 2016) through pre-patch releases up to 6.12.89/6.15-rc1 depending on distribution branch; essentially every mainstream Linux distribution shipping a kernel in that range is affected, including Debian 13, Ubuntu 22.04/24.04/26.04, Fedora 43/44, RHEL, SUSE, AlmaLinux, CloudLinux, and — per GovCERT.HK — F5's Linux-based appliance platforms F5OS 2.0.0 and Traffix SDC 5.2.0. Disclosure ran through Qualys reporting privately to the upstream kernel security contact on 2026-05-11, a public patch commit (31e62c2ebbfd, "ptrace: slightly saner get_dumpable() logic") and CVE assignment on 2026-05-14, public oss-security disclosure on 2026-05-15, and a full Qualys technical writeup on 2026-05-22, ahead of GovCERT.HK's downstream F5-specific alert two months later on 2026-07-15.
The primary interim mitigation, absent an immediate patch, is raising kernel.yama.ptrace_scope to 2 (admin-only ptrace attach), which blocks pidfd_getfd()'s reliance on __ptrace_may_access() — at the operational cost of breaking standard debugging tooling (gdb, strace, perf), browser crash reporters, and container debug/checkpoint workflows (CRIU, kdump). The durable fix is the upstream kernel patch and vendor-supplied updated kernel builds, which F5 states it has shipped for F5OS and Traffix SDC per K000162205.
MITRE ATT&CK techniques used in TL-2026-1503
Credential Access
T1003 OS Credential Dumping; T1552 Unsecured Credentials
Collection
Lateral Movement
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Execution
T1059 Command and Scripting Interpreter; T1559 Inter-Process Communication
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism
Persistence
Defense Evasion
T1211 Exploitation for Stealth
privilege-escalation
Affected products and versions in F5OS / Traffix SDC Information Disclosure (CVE-2026-46333)
- F5 — F5OS
Vulnerable versions: 2.0.0
Fixed in: see K000162205 - F5 — Traffix SDC
Vulnerable versions: 5.2.0
Fixed in: see K000162205 - Linux — Linux Kernel
Vulnerable versions: v4.10-rc1 through 5.10.256; 5.11 through 5.15.207; 5.16 through 6.1.173; 6.2 through 6.6.139; 6.7 through 6.12.89
Fixed in: commit 31e62c2ebbfd and later stable backports - Canonical — Ubuntu
Vulnerable versions: 22.04 pre-5.15.0-181.191; 24.04 pre-6.8.0-124.124; 25.10 pre-6.17.0-35.35; 26.04 pre-7.0.0-22.22
Fixed in: 5.15.0-181.191; 6.8.0-124.124; 6.17.0-35.35; 7.0.0-22.22 - Debian — Debian GNU/Linux
Vulnerable versions: 13 (trixie), pre-patch kernel
Fixed in: patched kernel per DSA - Red Hat — Red Hat Enterprise Linux
Vulnerable versions: pre-patch kernel branches
Fixed in: RHSA kernel updates - Fedora Project — Fedora
Vulnerable versions: 43; 44 (pre-patch)
Fixed in: patched kernel packages
Remediation for F5OS / Traffix SDC Information Disclosure (CVE-2026-46333)
Patches
- F5 Knowledge Article K000162205 (F5OS 2.0.0, Traffix SDC 5.2.0)
- Upstream Linux kernel commit 31e62c2ebbfd
- Ubuntu: linux 7.0.0-22.22 (26.04), 6.17.0-35.35 (25.10), 6.8.0-124.124 (24.04), 5.15.0-181.191 (22.04)
Immediate actions
- Apply F5 patched builds per Knowledge Article K000162205 for F5OS 2.0.0 and Traffix SDC 5.2.0
- Raise kernel.yama.ptrace_scope to 2 (admin-only ptrace attach) as an interim mitigation on any affected Linux host/appliance that cannot be patched immediately
- Audit for unexpected SUID/SGID binary execution patterns (chage, passwd, ssh-keysign) via auditd/eBPF
Workarounds
- sudo sysctl -w kernel.yama.ptrace_scope=2
- Restrict local shell access on affected hosts/appliances until patched
Longer-term hardening
- Upgrade to a kernel release containing commit 31e62c2ebbfd ("ptrace: slightly saner get_dumpable() logic") or later
- Deploy EDR/HIDS behavioral detection for pidfd_getfd(2) syscall usage combined with race-timed access to dying SUID processes
- Reduce reliance on SUID-root binaries where feasible; move privileged operations behind capability-scoped daemons
CVEs associated with F5OS / Traffix SDC Information Disclosure (CVE-2026-46333)
CVE-2026-46333
Weaknesses (CWE) in F5OS / Traffix SDC Information Disclosure (CVE-2026-46333)
CWE-269, CWE-362
Timeline of F5OS / Traffix SDC Information Disclosure (CVE-2026-46333)
- Qualys Threat Research Unit privately reports the ptrace/get_dumpable() race condition to the upstream Linux kernel security contact.
- Upstream kernel patch commit 31e62c2ebbfd ("ptrace: slightly saner get_dumpable() logic") is committed publicly and CVE-2026-46333 is assigned.
- CVE-2026-46333 is formally published in Canonical's Ubuntu Security tracker with a Priority of 'High' but an independently-computed CVSS 3 score of 5.5 (Medium) — lower than Qualys' informal 7.1 estimate, reflecting divergent vendor views on real-world exploitation impact/scope for the same race condition.
- Public disclosure posted to the oss-security mailing list; distribution security teams begin shipping patched kernel packages.
- Qualys publishes detailed technical analysis blog covering the four exploit chains (chage, ssh-keysign, pkexec, accounts-daemon).
- Qualys publishes the full coordinated-disclosure advisory; CHARON and ssh-keysign-pwn public PoCs surface on GitHub shortly after.
- Ubuntu Security Notices tracker last updated with fixed kernel package versions across 22.04/24.04/25.10/26.04.
- GovCERT.HK issues High Threat Security Alert A26-07-23 flagging CVE-2026-46333 in F5OS 2.0.0 and Traffix SDC 5.2.0, citing public PoC availability and urging immediate patching per F5 K000162205.
Sources cited for F5OS / Traffix SDC Information Disclosure (CVE-2026-46333)
- GovCERT.HK High Threat Security Alert A26-07-23: Vulnerability in F5 Products
- F5 Knowledge Article K000162205
- CVE-2026-46333 Detail - NVD
- CVE Record: CVE-2026-46333
- CVE-2026-46333: Local Root Privilege Escalation and Credential Disclosure in the Linux Kernel ptrace Path
- CVE-2026-46333 | Ubuntu Security Notices
- CHARON — pre-built PoC for CVE-2026-46333 (Linux ptrace mm==NULL fd theft)
- ssh-keysign-pwn, The Linux fd theft bug behind CVE-2026-46333
- CVE-2026-46333: Linux Kernel Privilege Escalation Flaw - SentinelOne
- PoC Released: Critical Linux Kernel ptrace Flaw Publicly Disclosed
Threats related to F5OS / Traffix SDC Information Disclosure (CVE-2026-46333)
- RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition Local Privilege Escalation (CVE-2026-64600)
- Wiz's Atlas AI Vulnerability Researcher Uncovers Critical GitHub RCE (CVE-2026-3854) and 200+ Unknown OSS Vulnerabilities
- CVE-2026-46215: Linux Kernel DRM GEM_CHANGE_HANDLE Use-After-Free Local Root Privilege Escalation
- Linux Kernel 'Copy Fail' Local Privilege Escalation (CVE-2026-31431) — algif_aead 4-Byte Page Cache Write to setuid Root
- Linux Kernel act_pedit Partial Copy-on-Write Page-Cache Corruption Local Privilege Escalation (CVE-2026-46331, "pedit COW")
- CVE-2026-31431 "Copy Fail" — Linux Kernel algif_aead Deterministic Local Privilege Escalation Affecting All Major Distributions
Detection coverage for TL-2026-1503
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1503 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.