kernel registry: add CVE-2026-46333 ptrace exit-race (ssh-keysign-pwn)

[JChamblee99]

Add CVE-2026-46333 ("ssh-keysign-pwn") detection to the LinPEAS kernel exploit registry.

Summary: local root privilege escalation / credential disclosure via a logic flaw in __ptrace_may_access() — during the process-exit window an unprivileged caller can use pidfd_getfd(2) to steal root-owned file descriptors (ssh-keysign host keys, /etc/shadow).

Updated:

• linPEAS/builder/linpeas_parts/variables/kernel_cve_registry_data.sh
• linPEAS/builder/linpeas_parts/functions/kernel_cve_registry_checks.sh

What changed:

• Added CVE-2026-46333 to the kernel registry in a new KERNEL_CVE_DATA_22 chunk.
• Used split version ranges, keyed to the upstream stable fix versions, to avoid overmatching LTS backports:
  • 4.10 to <5.10.256
  • 5.11 to <5.15.207
  • 5.16 to <6.1.173
  • 6.2 to <6.6.139
  • 6.7 to <6.12.89
  • 6.13 to <6.18.31
  • 6.19 to <7.0.8
• Added the pre-4.10 stable-branch backport introductions (branches EOL'd without a fix):
  • 3.16.52 to <3.17
  • 4.4.40 to <4.5
  • 4.8.16 to <4.9
  • 4.9.1 to <4.10
• Added sysctl prerequisite so mitigated hosts are not flagged:
  • sysctl:kernel.yama.ptrace_scope!=2
• Wired the new chunk into the reader: extended the KERNEL_CVE_ALL_DATA concatenation and the Global Variables metadata in kernel_cve_registry_checks.sh, and bumped the chunk range to 1..22.
• Updated the data file header date to 11-06-2026.

Build validation:

• Passed: python3 -m builder.linpeas_builder --include "Kernel_Exploit_Registry" --output /tmp/linpeas_kernel.sh
• Passed: python3 -m builder.linpeas_builder --all --output /tmp/linpeas_fat.sh

Notes:

• bash -n syntax check clean on the generated output.
• The generated scripts contain all 11 CVE-2026-46333 rows.
• Known limitation (accepted): matching is against upstream version ranges, so backported distro kernels (e.g. Ubuntu 7.0.0-22, which carries the fix in the package revision) are still reported as candidates — consistent with the rest of the registry and linux-exploit-suggester behavior.

Sources:

• kernel.org CVE record https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-46333.mbox
• Qualys TRU advisory: https://blog.qualys.com/vulnerabilities-threat-research/2026/05/20/cve-2026-46333-local-root-privilege-escalation-and-credential-disclosure-in-the-linux-kernel-ptrace-path
• POC Tested: https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn