Sysdig details six Linux flaws, including public root exploit for ZDI-CAN-33367
Summary
Sysdig analyzes six ZDI-reported Linux flaws, including ZDI-CAN-33367, a local privilege-escalation bug with a public PoC reproduced by TuxCare. No in-the-wild exploitation was reported; fixes and exposure vary by flaw.
Key points
- The article says none of the six ZDI reports had a CVE assigned as of Oct. 22, 2026; no in-the-wild exploitation had been reported.
- TuxCare reproduced a public PoC for ZDI-CAN-33367, which can grant local root access on tested Ubuntu, Debian, and AlmaLinux releases. A fix was posted but had not been merged.
- ZDI-CAN-33367 exploits a gap in the Dirty Frag fix: skb_zerocopy() fails to preserve a shared-page marker, allowing in-place decryption to modify page-cache contents.
- Two flaws affect ksmbd, not Samba: ZDI-CAN-33774 can leak kernel heap data or crash the host before authentication; ZDI-CAN-33549 involves an SMB Direct heap overflow and requires RDMA and a writable share.
- The other reports concern a VMware guest driver flaw, an nvmet information leak, and a ConnMan DNS proxy stack overflow; the ConnMan issue is a userspace bug and outside the kernel scope.
- Sysdig describes a distinctive syscall sequence for detecting ZDI-CAN-33367 and says a new Sysdig Secure runtime rule matches it; detection for the other flaws was still in development.
- Recommended steps include tracking fixes, restricting unprivileged user namespaces where feasible, enforcing Kubernetes RuntimeDefault seccomp, and inventorying or limiting ksmbd and VMware guest exposure.
Article Details
- Vulnerability Types
- Kernel page-cache corruption caused by skb_zerocopy() not preserving the shared-fragment marker
- Race condition in ksmbd protocol dispatch causing an out-of-bounds read
- Integer underflow leading to a heap overflow in the SMB Direct RDMA transport
- Out-of-bounds write in vmwgfx
- Uninitialized-memory information disclosure in nvmet
- Userspace stack overflow in the ConnMan DNS proxy
- Severity
- CVSS 9.0 for ZDI-CAN-33774 and ZDI-CAN-33549; CVSS 8.8 for ZDI-CAN-34068; CVSS 7.8 for ZDI-CAN-33367. The other reports are unscored or unknown.
- Affected Versions
- AlmaLinux 8–10
- CloudLinux 9–10
- Debian 12 and 13
- Ubuntu 24.04 and 26.04
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- Restrict unprivileged user namespaces; the article says this should block the ZDI-CAN-33367 PoC, though TuxCare had not validated this against the PoC.
- Block the nlmon and act_pedit modules where possible; the article cautions this may not close every path to the bug.
- Enforce seccomp RuntimeDefault for Kubernetes pods.
- Unload and block the ksmbd module on hosts that do not need it.
- Restrict TCP 445 to trusted networks where ksmbd must remain enabled.
- Disable SMB Direct unless the storage network depends on RDMA.
- On guests that do not need it, disable 3D acceleration or prevent the vmwgfx module from loading.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe public ZDI-CAN-33367 PoC uses a local kernel flaw to escalate from an ordinary unprivileged process to root.T1210 · Exploitation of Remote ServicesPublic PoCs for the ksmbd reports use crafted SMB traffic against remotely reachable services; the article describes heap disclosure or crashes, not confirmed in-the-wild exploitation.
CVE
CVE-2026-43284Earlier this year, Dirty Frag (CVE-2026-43284) showed defenders how an unprivileged user could get the kernel's IPsec ESP code to decrypt in place over pages that belong to the page cache. Those pages back a file theCVE-2026-43503Frag-copy and shift helpers: CVE-2026-43503CVE-2026-46300Coalescing: CVE-2026-46300CVE-2026-53363IPTFS: CVE-2026-53363, CVE-2026-64566CVE-2026-64566IPTFS: CVE-2026-53363, CVE-2026-64566CVE-2026-80977An error-handling helper: CVE-2026-80977CVE-2026-90049Another error path inside skb_zerocopy() itself: CVE-2026-90049
People
Eric DumazetReviewed the posted skb_zerocopy() patch for ZDI-CAN-33367.Greg Kroah-HartmanReplied on dri-devel about ZDI-CAN-34068, pointing to the vmwgfx dirty-tracking code.Namjae JeonThe ksmbd maintainer wrote the fix for the dispatch race later tracked as ZDI-CAN-33774; the fix was queued in the maintainer tree but had not reached a released kernel.Stefan MetzmacherThe SMB Direct maintainer said he believed a fix in his Linux 7.5 branch covered ZDI-CAN-33549; this had not been confirmed.
Vendors
Sysdigfalco feeds by sysdigTrend Microfor a Linux kernel bug is now public, before it has a CVE or a merged fix. On October 20, 2026, Trend Micro’s Zero Day Initiative (ZDI) sent one report, a bug in the ConnMan network manager, to the publicTuxCareof this blog. However, security teams should work to get detections and mitigations in place now. TuxCare has reproduced the public proof of concept (PoC) for ZDI-CAN-33367 from the ZDI report. Exploitation
Products
AlmaLinuxfor ZDI-CAN-33367 from the ZDI report. Exploitation leads to root access on current Ubuntu, Debian, and AlmaLinux distributions. CloudLinuxTuxCare reproduced a root shell on AlmaLinux 8–10, CloudLinux 9–10, Debian 12 and 13, and Ubuntu 24.04 and 26.04. AlmaLinux was rooted with the Dirty Frag fix installed. CentOS 6 and 7 kernels are not vulnerable. TheConnMana merged fix. On October 20, 2026, Trend Micro’s Zero Day Initiative (ZDI) sent one report, a bug in the ConnMan network manager, to the public ConnMan mailing list. On October 21, ZDI sent five reports to the LinuxDebian Linuxconcept (PoC) for ZDI-CAN-33367 from the ZDI report. Exploitation leads to root access on current Ubuntu, Debian, and AlmaLinux distributions. KubernetesEnforce seccomp RuntimeDefault on Kubernetes pods. The exploit starts by creating a user namespace, so containers that can call unshare(CLONE_NEWUSER) are in play. Docker's default seccomp profile blocks that call, butLinux kernelA working root exploit for a Linux kernel bug is now public, before it has a CVE or a merged fix. On October 20, 2026, Trend Micro’s Zero Day Initiative (ZDI) sent one report, a bug in the ConnMan network manager, toSysdig SecureSysdig Secure customers are covered by a new runtime rule in the Sysdig Runtime Behavioral Analytics policy, Page Cache Poisoning via Spliced File Pages to Loopback, which matches the syscall patterns as seen forUbuntuof concept (PoC) for ZDI-CAN-33367 from the ZDI report. Exploitation leads to root access on current Ubuntu, Debian, and AlmaLinux distributions. VMwareAlmaLinux releases. Two affect only hosts running ksmbd, the in-kernel SMB server. Another affects only VMware guests.