A working exploit for a Linux kernel flaw has been made public before the bug received a CVE identifier or a merged upstream fix.
Trend Micro's Zero Day Initiative (ZDI) sent that report and five others to maintainers and public mailing lists on October 20 and 21, according to analysis published by the Sysdig Threat Research Team on October 24.
No in-the-wild exploitation had been reported when Sysdig published its analysis, but several flaws still had no fix in any released kernel.
Public Disclosure Creates Patch Gap
ZDI-CAN-33367, the flaw with the public exploit, is a local privilege escalation (LPE) bug in the Linux networking stack that ZDI gave a CVSS score of 7.8. It can allow an unprivileged user to alter the in-memory contents of files they can only read.
It sits in a code path the kernel's fix for the earlier Dirty Frag page-cache flaws missed. Linux support provider TuxCare reproduced a root shell with the public proof of concept (PoC) on AlmaLinux 8 through 10, CloudLinux 9 and 10, Debian 12 and 13 and Ubuntu 24.04 and 26.04, Sysdig said.
Two of the other five, ZDI-CAN-33774 and ZDI-CAN-33549, are the highest rated, at 9.0, and affect ksmbd, the kernel's Server Message Block (SMB) server. The first is a remote, pre-authentication flaw that can leak kernel memory and crash systems, while the second requires SMB Direct, a Remote Direct Memory Access (RDMA) interface and a writable share.
Read more: Rushed Patches Follow Broken Embargo on New Linux Kernel Vulnerabilities
Exposure Varies Across Linux Systems
Of the remaining three, ZDI-CAN-34068 is an LPE rated 8.8 in the kernel's VMware graphics driver. Sysdig said there was no patch and only the report's title was public.
The last two are ZDI-CAN-34076, an information leak in the kernel's Non-Volatile Memory Express (NVMe) target, and ZDI-CAN-32005, a userspace stack overflow in the ConnMan network manager.
Sysdig said defenders should prioritize by the components they run rather than CVSS scores. It advised unloading ksmbd where it is not needed, restricting port 445 to trusted networks where it must stay and watching for a vmwgfx patch on VMware guests.
For ZDI-CAN-33367, Sysdig said restricting unprivileged user namespaces should block the public PoC, though TuxCare had not validated this, and noted that rootless containers depend on them. AlmaLinux had patched kernels in testing, but not production, by October 23.
The disclosure leaves a fragmented patching picture, but the public root exploit makes ZDI-CAN-33367 the most immediate concern of the six.