OpenSSH scp: file fetched as root with -O and without -p can land setuid or setgid

Impact

When root downloads a file with scp using the legacy protocol (-O) and does not pass -p, the remote side can cause the resulting local file to be created setuid or setgid. A hostile or compromised server on the other end therefore gets a setuid-root binary written onto the client machine, which any local user can then execute - a straightforward local privilege escalation on the box that ran the copy. The narrow condition is what limits this: it needs root, -O, and no -p. Provisioning and image-build scripts that still pin -O for compatibility are the realistic place this fires on a fleet, and they typically run as root against the same source across many nodes.

Who can reach it

Requires the operator to run scp as root with -O and without -p against a server the attacker controls or has compromised. No credentials on the client are needed; the attacker's position is on the remote end of the transfer.

What to do

Upgrade to OpenSSH 10.3 / 10.3p1 or a distribution backport - Red Hat has shipped RHSA-2026:12389 and RHSA-2026:13380. This is a client-side binary, so updating the openssh package is sufficient; no sshd restart or node reboot is required for the fix itself. As an immediate mitigation, drop -O from root-run scp invocations or move them to sftp.

References

Related entries

• Linux kernel (virt/kvm): The dirty-ring reset path bounds-checks an offset with unchecked 64-bit arithmetic, so aCVE-2026-52969 · Linux kernel (virt/kvm)High
• Linux kernel (arch/x86/kvm/svm): VMLOAD/VMSAVE executed by an L2 guest and not intercepted by L1 were emulated againstCVE-2026-43133 · Linux kernel (arch/x86/kvm/svm)High
• Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_user: Straight local-to-root. RDS - theCVE-2010-3904 · Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_userHigh
• Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pages: When an IOMMU mapping failsCVE-2014-3601 · Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pagesHigh
• Linux kernel (mm, COW): Dirty COW: privilege escalation via MAP_PRIVATE COW breakageCVE-2016-5195 · Linux kernel (mm, COW)High
• Linux kernel VFIO drivers/vfio/pci/vfio_pci.c - VFIO_DEVICE_SET_IRQS ioctl: A state-machine confusion inCVE-2016-9083 · Linux kernel VFIO drivers/vfio/pci/vfio_pci.c - VFIO_DEVICE_SET_IRQS ioctlHigh