CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Linux kernel ksmbd

product · product:linux-kernel-ksmbd

Coverage
1
first 2026-10-25 → last 2026-10-25
Latest activity
2026-10-25
Public root exploit for a Linux page-cache write that gets past the Dirty Frag fix; no CVE and no merged fix…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
4
4 hosts

Defender insights

What each entry about Linux kernel ksmbd tells a defender to do, newest first.

2026-10-25NOTABLEPublic root exploit for a Linux page-cache write that gets past the Dirty Frag fix; no CVE and no merged fix yet

Exposure · detection

Story timeline

  1. 2026-10-25Linux kernel ZDI-CAN-33367: a public local root exploit for an skb_zerocopy page-cache write that gets past the Dirty Frag fix, with no CVE and no merged fix, among six reports Trend Micro's ZDI copied to public lists, two of them ksmbd flaws scored CVSS 9.0
    trending-vulnerabilitiesPublic root exploit for a Linux page-cache write that gets past the Dirty Frag fix; no CVE and no merged fix yet

Hunting pivots

Releases covered
Linux kernel ksmbd
Tags
lpepoc-publicvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Privilege EscalationExploitation for Privilege Escalation
  • Lateral MovementExploitation of Remote Services

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-10-25/zdi-linux-kernel-reports-public-skb-zerocopy-root-exploit · ATT&CK page ↗

Lateral Movement TA0008

T1210Exploitation of Remote Services×1

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

Evidence: 2026-10-25/zdi-linux-kernel-reports-public-skb-zerocopy-root-exploit · ATT&CK page ↗

Entries about Linux kernel ksmbd (1)

2026-10-25 · view entry permalink →

NOTABLENATOB2

Linux kernel ZDI-CAN-33367: a public local root exploit for an skb_zerocopy page-cache write that gets past the Dirty Frag fix, with no CVE and no merged fix, among six reports Trend Micro's ZDI copied to public lists, two of them ksmbd flaws scored CVSS 9.0

On 2026-10-21 Trend Micro's Zero Day Initiative sent five Linux kernel reports and copied public mailing lists on every one, several with no fix in any released kernel; none of the six reports, a ConnMan one included, has a CVE (Sysdig, 2026-10-24). ZDI-CAN-33367 matters most: skb_zerocopy() moves shared page-cache pages into a new socket buffer without the marker the Dirty Frag fix added, so IPsec ESP decrypts in place and an unprivileged local user writes attacker bytes into the cached copy of a read-only file, which gives root through a setuid binary or /etc/passwd; the public exploit needs unprivileged user namespaces and networking modules such as nlmon and act_pedit (Sysdig, 2026-10-24). TuxCare reproduced a root shell on AlmaLinux 8 to 10 (Dirty Frag fix installed), CloudLinux 9 and 10, Debian 12 and 13 and Ubuntu 24.04 and 26.04 (AppArmor user-namespace restriction bypassed) (Sysdig, 2026-10-24). A reviewed patch is on netdev but not merged, TuxCare says no fix has been merged upstream or shipped in a distribution kernel, and a kernel with only the fix for CVE-2026-90049, a bug in the same function, is not covered (Sysdig, 2026-10-24; TuxCare, 2026-10-22). TuxCare's rebootless KernelCare patch is out for EL10, with EL9 in review, EL8 in progress and Debian and Ubuntu not started (TuxCare, 2026-10-22).

Two reports concern ksmbd, the kernel's own SMB server, not Samba. ZDI-CAN-33774 is a pre-authentication race in the SMB1 or SMB2 handler choice: its public proof of concept leaks 28 bytes of kernel heap per attempt and can crash the kernel, ZDI labels it remote code execution, nothing public shows code execution, and a fix is queued in ksmbd-for-next (Sysdig, 2026-10-24; Phoronix, 2026-10-22). ZDI-CAN-33549 is an SMB Direct integer underflow that needs an RDMA interface, a writable share and an SMB Direct client, and its proof of concept crashes the kernel (Sysdig, 2026-10-24). ZDI scores both 9.0, and Red Hat Enterprise Linux does not include ksmbd by default (The Hacker News, 2026-10-22). The other two reports, a vmwgfx and an nvmet flaw, have only titles public.

A working root exploit for a Linux kernel bug is now public, before it has a CVE or a merged fix.

None of the six bugs has been assigned a CVE ID yet, and no in-the-wild exploitation has been reported as of the publication of this blog.

Nothing legitimate does all of that from a single unprivileged process.

Sysdig Threat Research Team 2026-10-24

it gets around May’s fix for Dirty Frag (CVE-2026-43284), and no fix has been merged upstream or shipped in a distro kernel.

The public PoCs show a kernel heap leak and crashes rather than code execution, though that doesn’t rule out worse.

TuxCare 2026-10-22

Builds on: Dirty Frag: two kernel page-cache write flaws give local root; Microsoft saw su escalation that…

vulnerability25 Oct 03:35Zmulti-sourceOpen finding →
Sources: Sysdig Threat Research Team · TuxCare · The Hacker News · Phoronix

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • phoronix.com1 (25%)
  • sysdig.com1 (25%)
  • thehackernews.com1 (25%)
  • tuxcare.com1 (25%)
All cited sources (4)