A public root exploit for ZDI-CAN-33367, a pre-CVE Linux kernel LPE, targets Ubuntu, Debian, and AlmaLinux with no merged fix yet. Five more Linux flaws disclosed simultaneously, two rated CVSS 9.0, widen the exposure window for defenders this week. Key findings: - ZDI-CAN-33367 is the seventh path to drop the Dirty Frag flag first introduced by CVE-2026-43284. skb_zerocopy() moves shared page-cache pages into a new socket buffer without carrying the shared-frag marker, so ESP decrypts in place and writes attacker-controlled bytes into the page cache. The code path dates to kernel 3.14. A patch ("net: skbuff: propagate shared-frag marker in skb_zerocopy()") is on netdev but unmerged. TuxCare confirmed a root shell on AlmaLinux 8-10, CloudLinux 9-10, Debian 12-13, and Ubuntu 24.04 and 26.04. A kernel carrying only the CVE-2026-90049 fix is not protected. - The exploit runs entirely as an ordinary unprivileged user process through a fixed syscall sequence: unshare into new user and network namespaces, write sysctls, bring up an nlmon interface, install XFRM state over netlink, add an nftables NFQUEUE rule, attach a tc pedit action with a redirect, then splice() into a socket on 127.0.0[.]1. No KASLR leak required. Modules needed: nlmon, nft_queue, nfnetlink_queue, cls_u32, act_pedit, act_mirred, and esp4. - ZDI-CAN-33774 and ZDI-CAN-33549 are both CVSS 9.0 ksmbd bugs. 33774 is a pre-auth dispatch race that leaks 28 bytes of kernel heap per attempt and can crash the kernel. 33549 is an integer underflow in the SMB Direct RDMA transport leading to a heap overflow of up to 8 KB. Neither affects Samba (smbd). A fix for 33774 is in ksmbd-for-next but unreleased. Exposure check: look for the ksmbd kernel module, the ksmbd.mountd daemon, and a kernel-owned listener on TCP 445. - ZDI-CAN-34068 is a CVSS 8.8 out-of-bounds write in vmwgfx, the VMware virtual GPU kernel driver, exploitable only on VMware guests (vSphere, Workstation, VMware-based VDI). No patch exists. The trigger is DRM ioctl() calls on the vmwgfx device node by a local process. Sysdig TRT confirmed it does not reproduce on Lima or EC2 instances. Disabling 3D acceleration or blocking the vmwgfx module removes exposure on guests that do not need it. - None of the six bugs has a CVE ID assigned and no in-the-wild exploitation has been reported as of publication, but reproduction details were sent to public mailing lists before fixes merged, meaning attackers had the same disclosure window defenders did. DFIR takeaway: ZDI-CAN-33367 is the priority. The syscall sequence is distinctive enough to catch in motion: no legitimate unprivileged process unshares into both user and network namespaces, installs XFRM state, configures nftables NFQUEUE, attaches tc pedit, and then calls splice() to loopback. Instrument your runtime sensor for that chain. For ksmbd, runtime detection is a backstop only since the race and overflow happen inside kernel worker threads with no attacker process visible. Run inventory now: grep loaded modules and netstat output for ksmbd and TCP 445 across your estate. For Kubernetes, enforce seccomp RuntimeDefault cluster-wide via the kubelet --seccomp-default flag. Restrict unprivileged user namespaces (user.max_user_namespaces=0, or kernel.unprivileged_userns_clone=0 on Debian) on hosts that do not need rootless containers. Track these by ZDI ID until CVEs are assigned; your scanner will not find them yet. #DFIR_Radar
Post summary
The text discloses a publicly available root exploit for ZDI‑CAN‑33367 affecting Ubuntu, Debian, AlmaLinux and other Linux distributions, along with details on additional high‑severity kernel bugs, but notes that no CVE IDs or in‑the‑wild exploitation have been reported yet. It provides explicit exploitation steps, patch status, and DFIR detection/mitigation advice.
