Linux vulnerability allows hackers to bypass SSH authentication

A recently disclosed security flaw tracked as CVE-2026-123158, colloquially referred to as "*sshole," leaves certain Linux devices vulnerable to unauthorized access. According to reports from OX Security and The Hacker News, the issue involves an OpenSSH password authentication bypass affecting Alpine Linux and other distributions utilizing musl-libc.

The flaw allows unauthorized individuals to gain root access on affected systems by entering overly long passwords exceeding 256 characters. This vulnerability combines issues within both OpenSSH and musl-libc, impacting millions of systems globally and prompting the release of emergency patches.

Emergency Patches Issued

Security researchers and maintainers have rushed to release emergency fixes for the vulnerability. Publications including Tom's Hardware and The Register have urged system administrators to apply the available patches immediately to mitigate the risk of unauthorized remote login attempts.