A flaw in OpenSSH causes the session process to retain root privileges after authentication on platforms that cannot pass file descriptors and need root to allocate a terminal. This privilege escalation flaw (CWE-250) allows an authenticated user to perform privileged socket connections, bind to low‑numbered ports, and execute other privileged operations, compromising confidentiality, integrity, and availability of the host.

The issue affects OpenSSH servers on platforms lacking file descriptor passing support and requiring root for terminal allocation. No specific product versions were identified, so all such OpenSSH installations may be vulnerable. Administrators should verify whether their deployments meet these conditions and whether the vulnerability applies.

The CVSS score is 8.1, indicating high severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV. The attack vector is post‑authentication; an attacker must first authenticate to the SSH service to exploit the flaw. Because the issue permits elevation to root, there is a significant risk of data exfiltration, unauthorized service execution, or system compromise. Systems should treat this as high risk until patched.