Infosecurity Magazine reports that a working exploit for a Linux kernel flaw went public before it had a CVE or a merged upstream fix. Trend Micro’s Zero Day Initiative sent that report and five others to maintainers and public mailing lists on October 20 and 21, according to Sysdig’s analysis.
The one with the public exploit, ZDI-CAN-33367, is a local privilege escalation (CVSS 7.8) in the networking stack. It lets an unprivileged user change the in-memory contents of files they can only read, in a code path the earlier Dirty Frag fix missed. TuxCare got a root shell with the public PoC on AlmaLinux 8 through 10, CloudLinux 9 and 10, Debian 12 and 13, and Ubuntu 24.04 and 26.04. Sysdig said no in-the-wild exploitation had been reported yet.
The two highest rated (9.0) are in ksmbd, the kernel’s SMB server. One is a remote pre-auth memory leak and crash, and the other needs SMB Direct/RDMA and a writable share. There’s also an 8.8 LPE in the VMware graphics driver (vmwgfx) with no patch yet.
This comes right after PwnEscape (CVE-2026-99999), the kernel networking bug that let guest VMs read host memory, which I covered in PwnEscape: Patch Your Linux VM Hosts. It’s a rough month for the kernel.
Generic checklist
- Prioritize by what you actually run, as Sysdig advises, not just by CVSS score.
- Unload ksmbd where you don’t need it, and keep port 445 limited to trusted networks where you do.
- On VMware guests, watch for a vmwgfx patch.
- Keep kernel updates flowing from your distro and reboot into them.
God Bless, and Needs Garlic!
