
Research on `pidfd_getfd(2)`-based file descriptor leakage from privileged SUID processes. Demonstrates race-condition FD capture against OpenSSH `ssh-keysign` and exposure of sensitive root-owned file handles.
Research and educational repository for CVE-2026-46333, focused on reproducible analysis and a safe test PoC workflow.
This project documents the vulnerability behavior, test setup, and validation approach so researchers and defenders can reproduce findings responsibly.
This repository is intended for authorized, local, and controlled testing only.
Safe PoC notes are in docs/SAFE_TEST_POC.md.
Project background, goals, and roadmap are in docs/ABOUT.md.
go mod tidy
go build -o poc-test .
./poc-test <target-binary> [arg1 arg2 ...] [optional_file_to_capture]
Note: runtime execution is Linux-only because the PoC uses pidfd_* syscalls.
On non-Linux hosts, running ./poc-test intentionally exits with:
this PoC is Linux-only at runtime. Build with GOOS=linux to generate a Linux executable.
You can build a Linux executable from macOS, Linux, or Windows using Go cross-compilation:
# Linux amd64 binary
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags "-s -w" -o bin/poc-test-linux-amd64 .
# Linux arm64 binary
CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -trimpath -ldflags "-s -w" -o bin/poc-test-linux-arm64 .
These commands produce static ELF binaries (no shared libc dependency).
This repository includes:
bin/poc-test-linux-amd64bin/poc-test-linux-arm64Direct use on Linux (authorized test environments only):
chmod +x bin/poc-test-linux-amd64
./bin/poc-test-linux-amd64 <target-binary> [arg1 arg2 ...] [optional_file_to_capture]
Validated in this repo on May 17, 2026:
go mod tidy: successgo build -o poc-test .: success./poc-test on non-Linux host: expected Linux-only exit messageCGO_ENABLED=0 GOOS=linux GOARCH=amd64 ...: successCGO_ENABLED=0 GOOS=linux GOARCH=arm64 ...: successThis code is shared to support security research, validation, and patch verification. You are responsible for complying with all laws, policies, and authorization requirements.