Qualys exposes fourth Linux kernel SSH key theft flaw

Qualys has disclosed a fourth Linux kernel privilege escalation vulnerability in May alone, this one allowing unprivileged local users to extract SSH host private keys via a flaw in the kernel's cryptographic subsystem. The pace is striking: four distinct local privilege escalation bugs surfaced within two weeks, starting with ssh-keysign-pwn and followed by three additional disclosures in rapid succession. That cadence suggests a coordinated internal audit rather than independent discovery, meaning Qualys researchers may have mapped the vulnerability surface broadly before releasing findings in sequence. Essentially: (Qualys, Linux kernel maintainers) are in a disclosure sprint that has left security teams scrambling to patch across CI/CD pipelines and AI infrastructure before attackers catch up. - The SSH host key exposure path is particularly damaging: stolen host keys allow man-in-the-middle attacks on encrypted sessions without triggering standard authentication alerts. - All four flaws require only local, unprivileged access, lowering the attacker bar significantly on shared or multi-tenant infrastructure. - Unpatched kernel versions remain the attack surface, and patch availability varies across distributions and cloud provider AMIs. Four kernel LPEs in one month is a disclosure rate the Linux security ecosystem has rarely absorbed simultaneously, and the window between disclosure and broad patch deployment is exactly where exploitation risk peaks.