Linux Flaws Exposed as Public Exploit Targets Kernel Vulnerability

A working exploit for a Linux kernel flaw was made public before the bug received a CVE identifier or a merged upstream fix, according to reporting tied to Trend Micro’s Zero Day Initiative and analysis by the Sysdig Threat Research Team.

Trend Micro’s Zero Day Initiative and the public timeline

Trend Micro’s Zero Day Initiative (ZDI) sent a report and five others to kernel maintainers and public mailing lists on October 20 and 21, the Sysdig Threat Research Team said in an analysis published October 24. When Sysdig published its analysis, it reported no in-the-wild exploitation, but noted several of the reported flaws still had no fix in any released kernel. That sequencing—public exploit materials arriving before CVE assignment or upstream patch—creates a narrow window in which defenders must react without finalized fixes.

ZDI-CAN-33367: a public local root exploit and who it affects

ZDI-CAN-33367 is a local privilege escalation (LPE) bug in the Linux networking stack that ZDI scored 7.8 under CVSS. The flaw can allow an unprivileged user to alter the in-memory contents of files they can only read, and a proof of concept (PoC) exploit for the bug has been made public. Sysdig reported that Linux support provider TuxCare reproduced a root shell using the public PoC on AlmaLinux 8 through 10, CloudLinux 9 and 10, Debian 12 and 13, and Ubuntu 24.04 and 26.04.

Sysdig advised that restricting unprivileged user namespaces should block the public PoC for ZDI-CAN-33367, but also noted that TuxCare had not validated that mitigation and that rootless containers depend on unprivileged user namespaces. AlmaLinux had patched kernels in testing, but not in production, by October 23.

ksmbd issues: ZDI-CAN-33774 and ZDI-CAN-33549

Two of the six reports carry the highest ratings: ZDI-CAN-33774 and ZDI-CAN-33549 each received a 9.0 severity score and affect ksmbd, the kernel’s Server Message Block (SMB) server. ZDI-CAN-33774 is a remote, pre-authentication vulnerability that can leak kernel memory and crash systems. ZDI-CAN-33549 requires SMB Direct (an RDMA interface) and a writable share to be exploitable. Sysdig recommended defenders unload ksmbd where it is not needed and restrict port 445 to trusted networks where it must remain exposed.

Other kernel issues: vmwgfx, NVMe target, and ConnMan

The remaining three reports cover diverse components. ZDI-CAN-34068 is an LPE rated 8.8 in the kernel’s VMware graphics driver (vmwgfx); Sysdig said there was no patch available and only the report’s title was public. ZDI-CAN-34076 is an information leak in the kernel’s Non-Volatile Memory Express (NVMe) target. ZDI-CAN-32005 is a userspace stack overflow in the ConnMan network manager. Sysdig recommended watching for a vmwgfx patch on VMware guests and prioritizing mitigations based on components actually in use rather than by CVSS score alone.

What this means for technologists, enterprises, and end users

• Technologists and security teams: Prioritize defensive actions against the components you run, the analysis advised—unload ksmbd if unused, restrict port 445 to trusted networks, and watch for vmwgfx fixes on VMware guests. For ZDI-CAN-33367, consider restrictions on unprivileged user namespaces while recognizing the operational impact on rootless containers.
• Enterprise patch and operations leaders: The disclosures create a fragmented patching picture; AlmaLinux had fixes in testing but not production by October 23, and several flaws had no released kernel fix as of Sysdig’s October 24 analysis. That gap forces a choice between temporary mitigations and waiting for upstream, tested patches.
• End users and administrators of shared systems: The public PoC for ZDI-CAN-33367 raises immediate risk where unprivileged accounts exist on affected systems. Administrators should validate mitigations against their environment and monitor vendor channels for released kernel updates.

The combination of a publicly available exploit, multiple high-severity kernel flaws, and incomplete upstream fixes has created a compressed response window for defenders. ZDI-CAN-33367, because of its public root exploit and demonstrated reproduction across several distributions, stands out as the most immediate concern of the six reports, while ksmbd vulnerabilities present a separate, high-risk avenue for remote impact. Defenders are left balancing configuration-based mitigations, temporary workarounds, and the arrival of tested kernel patches.

Source: https://www.infosecurity-magazine.com/news/linux-flaws-exposed-before-fixes/