Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels.
0xdeadbeefnetwork/ssh-keysign-pwn has added +186 stars since the first tracked point, with current momentum at 17.20.