# F5OS / Traffix SDC Information Disclosure (CVE-2026-46333) — Linux Kernel ptrace/pidfd_getfd Race Condition, Public PoC (CHARON)

> GovCERT.HK issued a High Threat alert (A26-07-23) for CVE-2026-46333 affecting F5OS 2.0.0 and Traffix SDC 5.2.0, with public PoC exploit code available. Every authoritative technical source for this CVE ID (NVD, CVE.org, Red Hat, Ubuntu, SUSE, Debian, AlmaLinux, Qualys) describes it as a Linux kernel race condition in __ptrace_may_access()/get_dumpable() that lets an unprivileged local user abuse pidfd_getfd(2) during a privileged SUID process's exit to steal its open file descriptors — disclosing /etc/shadow and SSH host private keys, and enabling root command execution via pkexec/accounts-daemon. F5's affected appliance platforms (F5OS, Traffix SDC) bundle this vulnerable Linux kernel; F5 has released patched builds per K000162205.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1503
- **ID:** TL-2026-1503
- **Severity:** HIGH (CVSS 7.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-46333

## Description

GovCERT.HK's High Threat Security Alert A26-07-23 (published 2026-07-15) states that PoC exploit code is publicly available for an information-disclosure vulnerability affecting F5OS version 2.0.0 and Traffix SDC version 5.2.0, citing CVE-2026-46333 and F5 Knowledge Article K000162205 as the vendor reference; the F5 KB article itself could not be fetched directly (client-side loading error on two attempts), so downstream analysis relies on the CVE's independently-corroborated technical record, which is extensive and consistent across every authoritative source checked (NVD, CVE.org, Red Hat, Ubuntu, SUSE, Debian, AlmaLinux, Qualys).

CVE-2026-46333 is a nine-year-old logic flaw in the Linux kernel's ptrace subsystem, publicly disclosed and fixed in May 2026 by Qualys' Threat Research Unit. The root cause lies in __ptrace_may_access(), which short-circuits its dumpability check whenever task->mm == NULL. During process exit, the kernel's do_exit() calls exit_mm() before exit_files(), so for a brief window a dying privileged (often SUID-root) process has mm cleared but its file descriptor table still populated and still reachable. An unprivileged local attacker with the same UID as the dying process can race this window using the pidfd_getfd(2) syscall (introduced in Linux 5.6) to duplicate an open file descriptor out of the privileged process before it fully exits — sidestepping normal ptrace access controls entirely. F5's F5OS 2.0.0 and Traffix SDC 5.2.0 platforms run a Linux kernel within the affected version range, which is why GovCERT.HK's alert maps this generic Linux kernel CVE onto those specific F5 appliance products.

Qualys operationalized this into four working exploit chains using common SUID/SGID or root-daemon binaries as unwitting 'lures': chage or passwd (both open /etc/shadow) to disclose the shadow password database; ssh-keysign (SUID-root) to steal SSH host private keys, enabling host impersonation and lateral movement; pkexec, hijacked via its D-Bus connection, to execute arbitrary commands as root; and accounts-daemon, abused similarly, to gain root code execution. A public, dependency-free PoC named CHARON (github.com/KaraZajac/CHARON) automates the /etc/shadow and SSH host-key theft path with a reported sub-one-second success rate on a 4-core VM (~137 attempts average), and a second public PoC (ssh-keysign-pwn) targets the SSH host-key theft path specifically. At least 32 public PoC/exploit repositories reference this CVE — consistent with GovCERT.HK's statement that PoC code is publicly available for the F5-hosted instances of this kernel.

Affected kernel versions span from v4.10-rc1 (November 2016) through pre-patch releases up to 6.12.89/6.15-rc1 depending on distribution branch; essentially every mainstream Linux distribution shipping a kernel in that range is affected, including Debian 13, Ubuntu 22.04/24.04/26.04, Fedora 43/44, RHEL, SUSE, AlmaLinux, CloudLinux, and — per GovCERT.HK — F5's Linux-based appliance platforms F5OS 2.0.0 and Traffix SDC 5.2.0. Disclosure ran through Qualys reporting privately to the upstream kernel security contact on 2026-05-11, a public patch commit (31e62c2ebbfd, "ptrace: slightly saner get_dumpable() logic") and CVE assignment on 2026-05-14, public oss-security disclosure on 2026-05-15, and a full Qualys technical writeup on 2026-05-22, ahead of GovCERT.HK's downstream F5-specific alert two months later on 2026-07-15.

The primary interim mitigation, absent an immediate patch, is raising kernel.yama.ptrace_scope to 2 (admin-only ptrace attach), which blocks pidfd_getfd()'s reliance on __ptrace_may_access() — at the operational cost of breaking standard debugging tooling (gdb, strace, perf), browser crash reporters, and container debug/checkpoint workflows (CRIU, kdump). The durable fix is the upstream kernel patch and vendor-supplied updated kernel builds, which F5 states it has shipped for F5OS and Traffix SDC per K000162205.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1548 Abuse Elevation Control Mechanism
- T1211 Exploitation for Stealth
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1059 Command and Scripting Interpreter
- T1559 Inter-Process Communication
- T1005 Data from Local System
- T1078 Valid Accounts
- T1021 Remote Services

## Sources

- [GovCERT.HK High Threat Security Alert A26-07-23: Vulnerability in F5 Products](https://www.govcert.gov.hk/en/alerts_detail.php?id=1963)
- [F5 Knowledge Article K000162205](https://my.f5.com/manage/s/article/K000162205)
- [CVE-2026-46333 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-46333)
- [CVE Record: CVE-2026-46333](https://www.cve.org/CVERecord?id=CVE-2026-46333)
- [CVE-2026-46333: Local Root Privilege Escalation and Credential Disclosure in the Linux Kernel ptrace Path](https://blog.qualys.com/vulnerabilities-threat-research/2026/05/20/cve-2026-46333-local-root-privilege-escalation-and-credential-disclosure-in-the-linux-kernel-ptrace-path)
- [CVE-2026-46333 | Ubuntu Security Notices](https://ubuntu.com/security/CVE-2026-46333)
- [CHARON — pre-built PoC for CVE-2026-46333 (Linux ptrace mm==NULL fd theft)](https://github.com/KaraZajac/CHARON)
- [ssh-keysign-pwn, The Linux fd theft bug behind CVE-2026-46333](https://www.penligent.ai/hackinglabs/ssh-keysign-pwn/)
- [CVE-2026-46333: Linux Kernel Privilege Escalation Flaw - SentinelOne](https://www.sentinelone.com/vulnerability-database/cve-2026-46333/)
- [PoC Released: Critical Linux Kernel ptrace Flaw Publicly Disclosed](https://securityonline.info/linux-kernel-ptrace-vulnerability-poc-public-disclosure-root-file-theft/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1503