The 4th Linux kernel flaw this month can lead to stolen SSH host keys

ZDNet reports that Qualys disclosed a Linux kernel vulnerability (the fourth kernel flaw reported that month) that can be exploited to steal SSH host private keys. A patch has been released upstream, but fixes are not yet available from all Linux distributors. Operators should apply vendor kernel updates as soon as they are available, treat existing SSH host keys as potentially compromised (rotate/reissue keys and update known_hosts), restrict administrative and SSH access until kernels are patched, and audit systems for signs of compromise.