OpenSSH scp: file fetched as root with -O and without -p can land setuid or setgid

Impact

When root downloads a file with scp using the legacy protocol (-O) and does not pass -p, the remote side can cause the resulting local file to be created setuid or setgid. A hostile or compromised server on the other end therefore gets a setuid-root binary written onto the client machine, which any local user can then execute - a straightforward local privilege escalation on the box that ran the copy. The narrow condition is what limits this: it needs root, -O, and no -p. Provisioning and image-build scripts that still pin -O for compatibility are the realistic place this fires on a fleet, and they typically run as root against the same source across many nodes.

Who can reach it

Requires the operator to run scp as root with -O and without -p against a server the attacker controls or has compromised. No credentials on the client are needed; the attacker's position is on the remote end of the transfer.

What to do

Upgrade to OpenSSH 10.3 / 10.3p1 or a distribution backport - Red Hat has shipped RHSA-2026:12389 and RHSA-2026:13380. This is a client-side binary, so updating the openssh package is sufficient; no sshd restart or node reboot is required for the fix itself. As an immediate mitigation, drop -O from root-run scp invocations or move them to sftp.

References

Related entries

• Linux kernel x86/ftrace: dynamic trampoline mis-relocates per-cpu call-depth accounting, crashing the hostCVE-2026-64235 · Linux kernel x86 ftrace dynamic trampolines (CALL_DEPTH_ACCOUNT %rip-relative relocation)High
• Linux SLUB: krealloc __GFP_ZERO guarantee broken when red zoning is enabled without user trackingCVE-2026-64368 · Linux kernel SLUB allocator (init-on-alloc zeroing under SLAB_RED_ZONE)High
• Linux SUNRPC: unchecked percpu_counter_init leaves nfsd running on NULL per-cpu statsCVE-2026-89547 · Linux kernel SUNRPC (__svc_create per-pool percpu_counter init)High
• Linux NFSD: filecache shutdown race leaks nfsd_file objects and their stateCVE-2026-89667 · Linux kernel NFSD filecache (shrinker/GC/fsnotify vs per-net shutdown)High
• Linux kernel nfsd: use-after-free on the per-net file cache disposal queue during namespace teardownCVE-2026-89682 · Linux kernel nfsd (file cache delayed disposal, nfsd_fcache_disposal)High
• Linux kernel qla2xxx: use-after-free when a late response interrupt reaches an already-freed request queueCVE-2026-89848 · Linux kernel qla2xxx (qpair teardown, response IRQ vs request queue free)High