Linux kernel ZDI-CAN-33367: a public local root exploit for an skb_zerocopy page-cache write that gets past the Dirty Frag fix, with no CVE and no merged fix, among six reports Trend Micro's ZDI copied to public lists, two of them ksmbd flaws scored CVSS 9.0
Public root exploit for a Linux page-cache write that gets past the Dirty Frag fix; no CVE and no merged fix yet
Analysis
On 2026-10-21 Trend Micro's Zero Day Initiative sent five Linux kernel reports and copied public mailing lists on every one, several with no fix in any released kernel; none of the six reports, a ConnMan one included, has a CVE (Sysdig, 2026-10-24). ZDI-CAN-33367 matters most: skb_zerocopy() moves shared page-cache pages into a new socket buffer without the marker the Dirty Frag fix added, so IPsec ESP decrypts in place and an unprivileged local user writes attacker bytes into the cached copy of a read-only file, which gives root through a setuid binary or /etc/passwd; the public exploit needs unprivileged user namespaces and networking modules such as nlmon and act_pedit (Sysdig, 2026-10-24). TuxCare reproduced a root shell on AlmaLinux 8 to 10 (Dirty Frag fix installed), CloudLinux 9 and 10, Debian 12 and 13 and Ubuntu 24.04 and 26.04 (AppArmor user-namespace restriction bypassed) (Sysdig, 2026-10-24). A reviewed patch is on netdev but not merged, TuxCare says no fix has been merged upstream or shipped in a distribution kernel, and a kernel with only the fix for CVE-2026-90049, a bug in the same function, is not covered (Sysdig, 2026-10-24; TuxCare, 2026-10-22). TuxCare's rebootless KernelCare patch is out for EL10, with EL9 in review, EL8 in progress and Debian and Ubuntu not started (TuxCare, 2026-10-22).
Two reports concern ksmbd, the kernel's own SMB server, not Samba. ZDI-CAN-33774 is a pre-authentication race in the SMB1 or SMB2 handler choice: its public proof of concept leaks 28 bytes of kernel heap per attempt and can crash the kernel, ZDI labels it remote code execution, nothing public shows code execution, and a fix is queued in ksmbd-for-next (Sysdig, 2026-10-24; Phoronix, 2026-10-22). ZDI-CAN-33549 is an SMB Direct integer underflow that needs an RDMA interface, a writable share and an SMB Direct client, and its proof of concept crashes the kernel (Sysdig, 2026-10-24). ZDI scores both 9.0, and Red Hat Enterprise Linux does not include ksmbd by default (The Hacker News, 2026-10-22). The other two reports, a vmwgfx and an nvmet flaw, have only titles public.
Cited evidence
A working root exploit for a Linux kernel bug is now public, before it has a CVE or a merged fix.
None of the six bugs has been assigned a CVE ID yet, and no in-the-wild exploitation has been reported as of the publication of this blog.
Nothing legitimate does all of that from a single unprivileged process.
it gets around May’s fix for Dirty Frag (CVE-2026-43284), and no fix has been merged upstream or shipped in a distro kernel.
The public PoCs show a kernel heap leak and crashes rather than code execution, though that doesn’t rule out worse.
Sources4
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.