--- schema: 1 kind: vulnerability title: "Linux kernel ZDI-CAN-33367: a public local root exploit for an skb_zerocopy page-cache write that gets past the Dirty Frag fix, with no CVE and no merged fix, among six reports Trend Micro's ZDI copied to public lists, two of them ksmbd flaws scored CVSS 9.0" headline: "Public root exploit for a Linux page-cache write that gets past the Dirty Frag fix; no CVE and no merged fix yet" summary: > Trend Micro's Zero Day Initiative copied public Linux kernel lists on five kernel reports on 2026-10-21 before any fix was merged, and Sysdig ranks ZDI-CAN-33367 as the one to act on: a local privilege escalation through skb_zerocopy() that gets past the Dirty Frag fix, with a public exploit that TuxCare reproduced as root on AlmaLinux 8 to 10, CloudLinux 9 and 10, Debian 12 and 13 and Ubuntu 24.04 and 26.04. A reviewed patch is on netdev but not merged, none of the six reports has a CVE, and two ksmbd reports that ZDI scores CVSS 9.0 matter only where the in-kernel SMB server runs; no exploitation in the wild is reported. discovered_at: "2026-10-25T03:35:00Z" updated_at: null event_date: "2026-10-21" run_id: 2026-10-25T0256Z-intel priority: notable immediate_action: null tags: [vulnerabilities, lpe, poc-public] regions: [global] sectors: [] entities: ["product:linux-kernel", "product:linux-kernel-ksmbd", "trend:dirty-frag-linux-kernel-page-cache-lpe", "incident:zdi-linux-kernel-reports-public-lists-2026-10"] techniques: [T1068, T1210] affected_products: ["Linux kernel", "Linux kernel ksmbd"] cves: [] sources: - url: "https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws" publisher: "Sysdig Threat Research Team" date: "2026-10-24" role: primary - url: "https://tuxcare.com/blog/zdi-ksmbd-bugs-cve/" publisher: "TuxCare" date: "2026-10-22" role: corroborating - url: "https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html" publisher: "The Hacker News" date: "2026-10-22" role: corroborating - url: "https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities" publisher: "Phoronix" date: "2026-10-22" role: corroborating closed_sources: [] evidence: - quote: "A working root exploit for a Linux kernel bug is now public, before it has a CVE or a merged fix." publisher: "Sysdig Threat Research Team" source_url: "https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws" - quote: "None of the six bugs has been assigned a CVE ID yet, and no in-the-wild exploitation has been reported as of the publication of this blog." publisher: "Sysdig Threat Research Team" source_url: "https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws" - quote: "Nothing legitimate does all of that from a single unprivileged process." publisher: "Sysdig Threat Research Team" source_url: "https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws" - quote: "it gets around May’s fix for Dirty Frag (CVE-2026-43284), and no fix has been merged upstream or shipped in a distro kernel." publisher: "TuxCare" source_url: "https://tuxcare.com/blog/zdi-ksmbd-bugs-cve/" - quote: "The public PoCs show a kernel heap leak and crashes rather than code execution, though that doesn’t rule out worse." publisher: "TuxCare" source_url: "https://tuxcare.com/blog/zdi-ksmbd-bugs-cve/" verification: multi-source sourcing_note: > Sysdig is the original analysis and TuxCare independently reproduced the root exploit; the ksmbd remote-code-execution rating is ZDI's own score as the sources relay it, not a demonstrated result. Fix status is relayed through Sysdig, TuxCare and Phoronix as of 2026-10-24, because the kernel list archives sit behind a proof-of-work challenge; TuxCare lists no CVE and no distribution advisory yet. confidence: high references: - 2026-05-09/cve-2026-43284-cve-2026-43500-linux-dirty-frag-deterministic deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 2 watchlist_hit: false actions: [] updates: [] migrated_from: null --- On 2026-10-21 Trend Micro's Zero Day Initiative sent five Linux kernel reports and copied public mailing lists on every one, several with no fix in any released kernel; none of the six reports, a ConnMan one included, has a CVE ([Sysdig, 2026-10-24](https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws)). ZDI-CAN-33367 matters most: skb_zerocopy() moves shared page-cache pages into a new socket buffer without the marker the Dirty Frag fix added, so IPsec ESP decrypts in place and an unprivileged local user writes attacker bytes into the cached copy of a read-only file, which gives root through a setuid binary or /etc/passwd; the public exploit needs unprivileged user namespaces and networking modules such as nlmon and act_pedit ([Sysdig, 2026-10-24](https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws)). TuxCare reproduced a root shell on AlmaLinux 8 to 10 (Dirty Frag fix installed), CloudLinux 9 and 10, Debian 12 and 13 and Ubuntu 24.04 and 26.04 (AppArmor user-namespace restriction bypassed) ([Sysdig, 2026-10-24](https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws)). A reviewed patch is on netdev but not merged, TuxCare says no fix has been merged upstream or shipped in a distribution kernel, and a kernel with only the fix for CVE-2026-90049, a bug in the same function, is not covered ([Sysdig, 2026-10-24](https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws); [TuxCare, 2026-10-22](https://tuxcare.com/blog/zdi-ksmbd-bugs-cve/)). TuxCare's rebootless KernelCare patch is out for EL10, with EL9 in review, EL8 in progress and Debian and Ubuntu not started ([TuxCare, 2026-10-22](https://tuxcare.com/blog/zdi-ksmbd-bugs-cve/)). Two reports concern ksmbd, the kernel's own SMB server, not Samba. ZDI-CAN-33774 is a pre-authentication race in the SMB1 or SMB2 handler choice: its public proof of concept leaks 28 bytes of kernel heap per attempt and can crash the kernel, ZDI labels it remote code execution, nothing public shows code execution, and a fix is queued in ksmbd-for-next ([Sysdig, 2026-10-24](https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws); [Phoronix, 2026-10-22](https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities)). ZDI-CAN-33549 is an SMB Direct integer underflow that needs an RDMA interface, a writable share and an SMB Direct client, and its proof of concept crashes the kernel ([Sysdig, 2026-10-24](https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws)). ZDI scores both 9.0, and Red Hat Enterprise Linux does not include ksmbd by default ([The Hacker News, 2026-10-22](https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html)). The other two reports, a vmwgfx and an nvmet flaw, have only titles public. **Exposure:** a Linux host where a local user or workload can run code and unprivileged user namespaces are on (shared hosting, CI runners, container nodes, login nodes) on the distributions above. For ksmbd, look for the ksmbd module, the ksmbd.mountd daemon and a kernel-owned listener on TCP 445 ([Sysdig, 2026-10-24](https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws)). **Detection:** the exploit is one unprivileged process that unshares into new user and network namespaces and writes sysctls, brings up an nlmon interface, installs XFRM state over netlink, adds an nftables NFQUEUE rule, attaches a tc pedit action with a redirect and then calls splice() into a socket on the loopback address; Sysdig says nothing legitimate does all of that from one unprivileged process, so syscall-level runtime telemetry sees it ([Sysdig, 2026-10-24](https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws)). The write lands in the page cache, not the file, so a disk-content integrity check does not show it. **Defender takeaway:** restrict unprivileged user namespaces where nothing depends on them (Sysdig says user.max_user_namespaces=0 should block the public exploit, untested by TuxCare, and breaks rootless containers and some build tooling), do not rely on Ubuntu's AppArmor restriction, set seccomp RuntimeDefault on Kubernetes pods and patch the day the distribution ships the fix; unload ksmbd where unused and keep TCP 445 to trusted networks where it must stay ([Sysdig, 2026-10-24](https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws)).