CVE-2026-35385: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-35385 is a privilege escalation vulnerability in OpenSSH's scp client affecting all versions before 10.3. When a root user downloads files using the legacy scp protocol (-O flag) without the preserve-mode flag (-p), the downloaded files may retain or be installed with setuid or setgid bits set — contrary to expected behavior. This bug traces back to the original Berkeley rcp program and was reported by Christos Papakonstantinou of Cantina and Spearbit. It was publicly disclosed on April 2, 2026, alongside the OpenSSH 10.3 release. The CVSS v3.1 base score is 8.1 (High) per Feedly/NVD, or 7.5 (High) per the GitHub Advisory Database (GitHub Advisory, oss-security).

The root cause is classified as CWE-281 (Improper Preservation of Permissions): when scp operates in legacy mode (-O) as root without the -p flag, it fails to clear setuid/setgid bits from downloaded files, allowing those permission bits to persist on the destination filesystem. An attacker positioned to serve a malicious file during an scp transfer (e.g., via a compromised or malicious remote server) can craft a file with setuid/setgid bits set, which will then be installed with those elevated permissions on the downloading host. Exploitation requires the scp operation to be performed as root, using the legacy -O protocol flag, and without the -p (preserve mode) flag — a combination that may occur in automated scripts or administrative workflows (oss-security, GitHub Advisory).

Successful exploitation allows an attacker to place setuid or setgid files on the target system, enabling subsequent local privilege escalation to root or another privileged group. The confidentiality, integrity, and availability impacts are all rated High, as an attacker who can execute a setuid binary owned by root can fully compromise the affected system. The attack requires network access and a position to influence the files served during an scp transfer, but once a setuid file is placed, any local user can trigger privilege escalation (GitHub Advisory, oss-security).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.036%–0.067%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific combination of conditions: root-level scp, legacy -O mode, and absence of the -p flag, which limits the attack surface to particular administrative or automated workflows.

1. Reconnaissance: Identify target systems where root users perform scp downloads using the legacy -O protocol without the -p flag — common in automated backup or deployment scripts.
2. Position for file serving: Gain control of or compromise the remote SSH server from which the root user downloads files (e.g., via a separate vulnerability, insider access, or a man-in-the-middle position).
3. Prepare malicious file: Create a file on the remote server with setuid or setgid bits set (e.g., chmod u+s malicious_binary) and ensure it is owned by root or a privileged group.
4. Trigger the scp download: Wait for or induce the root user on the target system to execute scp -O remotehost:/path/to/malicious_binary /local/destination/ without the -p flag.
5. Exploit the placed file: Once the file is downloaded with setuid/setgid bits intact, any local user on the target system can execute the binary to gain elevated privileges (oss-security, GitHub Advisory).

• File System: Unexpected setuid (-rwsr-xr-x) or setgid (-rwxr-sr-x) files in directories where scp downloads are placed; newly created files with unusual permission bits in /tmp, /var, or application directories.
• Logs: SSH/scp access logs showing root-initiated scp sessions using legacy protocol to external or untrusted hosts; auth.log or secure log entries for root scp activity.
• Process: Execution of unexpected binaries with elevated privileges (setuid/setgid) by non-root users shortly after a root scp download event; auditd records showing execve calls on newly downloaded files with setuid bits.
• Network: Outbound scp/SSH connections from privileged accounts to external or unfamiliar hosts, particularly in automated or scheduled contexts.

Upgrade OpenSSH to version 10.3 or later, which clears setuid/setgid bits from files downloaded via scp in legacy mode (oss-security). Patches are also available from major Linux distributions including Red Hat, Ubuntu (USN-8222-1), Debian (DLA-4584-1), SUSE, Fedora, Amazon Linux, and IBM AIX (IBM Advisory). As an immediate workaround, avoid using scp -O (legacy mode) when running as root; use the default SFTP-based scp or always include the -p flag to preserve modes. Additionally, restrict root-level scp operations and apply the principle of least privilege for file transfer tasks.

The vulnerability was announced by OpenSSH developer Damien Miller on the oss-security mailing list alongside the OpenSSH 10.3 release on April 2, 2026, describing it as a relatively minor security fix tracing back to the original Berkeley rcp program (oss-security). Multiple Linux distributions and vendors including Red Hat, Ubuntu, Debian, SUSE, Fedora, Amazon Linux, IBM, Microsoft (Azure Linux), Juniper, and Palo Alto Networks issued advisories and patches in the weeks following disclosure. Community discussion on Mastodon and Bluesky noted the niche but real-world risk for environments using automated root scp workflows with legacy protocol flags.