OpenSSH sshd: password authentication bypass on musl libc builds without PAM

Impact

On systems where sshd is linked against musl libc and built without PAM, some account configurations accept any password between 256 and 1024 characters, giving an unauthenticated remote attacker interactive shell access as that account. Alpine Linux is the named example platform, which matters because Alpine is a common base for container images and for utility/jump hosts in a datacenter. Any Alpine-based bastion, management container or sidecar that exposes sshd with password authentication enabled is directly reachable login-bypass exposure, and from a management-network bastion that is the shortest path into the GPU fleet.

Who can reach it

Anyone who can reach port 22 on an affected host. No authentication and no valid credential needed - only a username whose password hash field is in the affected form. Only applies to sshd on musl libc builds with PAM not in use.

What to do

Upgrade to OpenSSH 10.6p2 or later (the upstream commit restores the workaround), then restart sshd; existing sessions are unaffected so this is a daemon restart, not a reboot. Until the package lands, disable password authentication (PasswordAuthentication no, keys only) on Alpine/musl hosts, which removes the exposure entirely. Inventory which hosts actually use musl without PAM before scheduling - glibc and PAM-enabled builds are not affected.

References

Related entries

• Linux kernel ibmvfc: a malicious VIO server leaks kernel memory through an unclamped target countCVE-2026-31464 · Linux kernel ibmvfc (IBM Power virtual FC discover-targets response)High
• OpenSSH scp: file fetched as root with -O and without -p can land setuid or setgidCVE-2026-35385 · OpenSSH scp (legacy SCP protocol mode, -O without -p)High
• Linux kernel x86/ftrace: dynamic trampoline mis-relocates per-cpu call-depth accounting, crashing the hostCVE-2026-64235 · Linux kernel x86 ftrace dynamic trampolines (CALL_DEPTH_ACCOUNT %rip-relative relocation)High
• Linux SLUB: krealloc __GFP_ZERO guarantee broken when red zoning is enabled without user trackingCVE-2026-64368 · Linux kernel SLUB allocator (init-on-alloc zeroing under SLAB_RED_ZONE)High
• Linux SUNRPC: unchecked percpu_counter_init leaves nfsd running on NULL per-cpu statsCVE-2026-89547 · Linux kernel SUNRPC (__svc_create per-pool percpu_counter init)High
• Linux NFSD: filecache shutdown race leaks nfsd_file objects and their stateCVE-2026-89667 · Linux kernel NFSD filecache (shrinker/GC/fsnotify vs per-net shutdown)High