Public exploit exposes Linux kernel flaw before a fix is available

A working exploit for a Linux kernel flaw has been made public before the bug received a CVE identifier or a merged upstream fix. Trend Micro’s Zero Day Initiative (ZDI) reported ZDI-CAN-33367 and five other flaws to maintainers and public mailing lists on 20–21 October, according to Sysdig Threat Research Team analysis published on 24 October. No in‑the‑wild exploitation had been reported at the time of Sysdig’s write‑up, but several flaws still had no patch in any released kernel.

ZDI-CAN-33367 is a local privilege escalation flaw in the Linux networking stack, rated CVSS 7.8, that can allow an unprivileged user to alter in‑memory contents of files they can only read. TuxCare reproduced a root shell with the public PoC on AlmaLinux 8–10, CloudLinux 9–10, Debian 12–13 and Ubuntu 24.04–26.04, Sysdig said.

Three other flaws—ZDI-CAN-33774 and ZDI-CAN-33549 (both 9.0) affect ksmbd, the kernel’s SMB server; ZDI-CAN-34068 (8.8) concerns the VMware graphics driver; and ZDI-CAN-34076 (information leak in NVMe target) and ZDI-CAN-32005 (userspace stack overflow in ConnMan) complete the set. Sysdig advised defenders to prioritise by components used, unloading ksmbd where unnecessary, restricting port 445 to trusted networks, and watching for a patch in vmwgfx for VMware guests.

For ZDI-CAN-33367, restricting unprivileged user namespaces may block the PoC, though validation by TuxCare had not occurred, and AlmaLinux had kernels in testing but not production by 23 October. The disclosure leaves a fragmented patching picture, with the public root exploit making ZDI-CAN-33367 the most immediate concern.