#patching

Özgün Kültekin of the security firm Wakefield published an illustrated write-up (under a pun on "ssh") of a login bypass in OpenSSH on Linux systems built on the musl C library, such as Alpine, OpenWrt, Buildroot and Yocto, when sshd runs without PAM. Locked or key-only accounts are marked with a "" instead of a password hash. Since 2012, musl's crypt() returns "" when it fails, and it fails on passwords over 256 bytes. Because sshd hashes a wrong password even for such accounts, a password of 257 to 1,024 characters produced "*" and matched. He says the flaw has existed since 2016 and that on Alpine's official AWS and Azure images the default user, which has passwordless doas, is affected, which amounts to root.

He says he found it by testing about 17,600 unusual logins across many sshd builds with "agent swarms". OpenSSH 10.6p2, released November 5, works around it in sshd; the OpenSSH team says it considers the root cause outside sshd. The fix is to upgrade or turn off password logins, and his GitHub repo has a check script.

In a November 2 post, the developer behind chalmovsky.com writes that he took all his Ubuntu servers offline and is moving them to another distribution. His complaint: CVE-2026-98432, a critical (CVSS 9.8) remotely reachable use-after-free in the Linux kernel's TCP code, had been patched by Debian on October 16, and Anthropic says it built a working root exploit, yet more than two weeks later every supported Ubuntu release, LTS included, was listed as vulnerable. He contrasts this with Ubuntu's promise of "timely patches for critical vulnerabilities" and with volunteer-run distributions (Debian, Arch, Alpine) that had shipped the fix.

Atlas's advisory, updated November 5, says Red Hat shipped fixed kernels on November 1 and AlmaLinux on November 2, while Ubuntu had a fixed kernel only for 26.10 and its fixes for 22.04, 24.04 and 26.04 were still in testing. Ubuntu's CVE page rates the bug Critical and offers an interim packet-filtering mitigation.