Public Linux kernel root exploit appears before a CVE or fix
Original title: Linux Flaws Exposed Before Fixes as Root Exploit Goes Public
Sysdig says six ZDI reports went to lists on October 20–21, and several still lack a released-kernel fix.
Trend Micro's Zero Day Initiative sent six Linux flaw reports to maintainers and public mailing lists on October 20 and 21, before CVE assignment or a merged upstream fix for the exploited bug, Sysdig reported on October 24. ZDI-CAN-33367 is a networking-stack local privilege escalation scored 7.8, with a public proof of concept that TuxCare used to get a root shell on several distributions. Two ksmbd bugs are scored 9.0. Sysdig said no in-the-wild exploitation was known when it published.
Unconfirmed: No CVE identifiers are stated, TuxCare had not validated the namespace mitigation, and in-the-wild use was not reported.
- TuxCare reproduced the PoC on AlmaLinux 8–10, CloudLinux 9 and 10, Debian 12 and 13, and Ubuntu 24.04 and 26.04.
- ZDI-CAN-33774 is a remote pre-authentication ksmbd flaw that can leak kernel memory and crash systems.
- ZDI-CAN-33549 needs SMB Direct, an RDMA interface and a writable share.
- ZDI-CAN-34068 is an 8.8 vmwgfx LPE with no patch and only the report title public.
- AlmaLinux had testing kernels, not production patches, by October 23.
Impact: Unprivileged local user can obtain a root shell
| Product | Affected |
|---|---|
| Linux kernel networking stack | — |
| Linux ksmbd | — |
| Linux vmwgfx | — |
| Linux NVMe target | — |
| ConnMan | — |
- 1.Unload ksmbd where it is not needed, or restrict port 445 to trusted networks.
- 2.Watch for a vmwgfx patch on VMware guests.
- 3.Consider restricting unprivileged user namespaces to block the ZDI-CAN-33367 PoC.
- Vendors
- Linux
- Products
- Linux kernelksmbdvmwgfxConnMan
- Organizations
- Zero Day InitiativeSysdigTuxCare
From the original article
2 min read at infosecurity-magazine.com
Six Linux flaws were made public, including one with a working root exploit and no merged fix
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.