Six Linux Kernel Reports & Public Root Exploit No CVE
ZDI published six Linux kernel vulnerability reports on Oct 20-21, 2026 without CVEs, featuring a public root exploit affecting major distributions.
Stock photo for illustration only, not from the actual event
- Zero Day Initiative sent six Linux kernel vulnerability reports on October 20-21, 2026
- None of the vulnerabilities had a CVE identifier assigned at the time of reporting
- ZDI-CAN-33367 features a working public proof of concept for local privilege escalation
- Sysdig advises prioritizing mitigation based on actual fleet component inventories
The Zero Day Initiative submitted six kernel vulnerability reports to maintainers and public mailing lists on October 20 and 21, 2026. By the time Sysdig's Threat Research Team analyzed them on October 24, one of these issues already had a working public proof of concept, several lacked fixes in any released kernel version, and none of them possessed a CVE identifier yet.
This combination creates a severe challenge for patching programs. A standard CVE provides asset owners with a recognizable handle such as a feed entry, scanner signature, vendor advisory, and fixed version. Without a CVE, identical information arrives merely as a mailing list thread containing a ZDI candidate number and a description of the impacted component.
Stock photo for illustration only, not from the actual event
Among the disclosures, ZDI-CAN-33367 stands out as a local privilege escalation within the Linux networking stack, rated 7.8 by ZDI. It allows an unprivileged user to alter in-memory contents of files they can only read. This code path bypassed the kernel's previous fixes for Dirty Frag page-cache flaws, meaning distributions that backported the Dirty Frag fix are not automatically protected against this new issue.
TuxCare successfully reproduced a root shell utilizing the public proof of concept across AlmaLinux versions 8 through 10, CloudLinux versions 9 and 10, Debian versions 12 and 13, and Ubuntu versions 24.04 and 26.04. This distribution list provides actionable intelligence for fleet owners to check their exposure directly rather than deciphering upstream kernel versions.
"A fleet that does not load ksmbd has no exposure to the two 9.0 findings, regardless of their rating."
Sysdig Threat Research Team
The two highest-rated reports, ZDI-CAN-33774 and ZDI-CAN-33549, both scored 9.0 and targeted ksmbd, the in-kernel SMB server. The first flaw is remote and pre-authentication, capable of leaking kernel memory and crashing systems, while the second requires SMB Direct, an RDMA interface, and a writable share, representing a much narrower precondition.
The absence of immediate CVE identifiers highlights a structural gap in current vulnerability disclosure workflows. When critical bugs surface with active exploits before official tracking numbers are assigned, security teams cannot rely solely on automated scanners keyed to CVE feeds. Maintaining an accurate component inventory and tracking vendor advisories via vendor candidate numbers become vital practices for mitigating zero-day risks effectively.
Additionally, ZDI-CAN-34068 is an 8.8-rated local privilege escalation in the kernel's VMware graphics driver lacking a patch and detailed public info at analysis time. Meanwhile, ZDI-CAN-34076 involves an information leak in the NVMe target, and ZDI-CAN-32005 is a userspace stack overflow in the ConnMan network manager, both residing outside the core kernel.
Source: Dev.to
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment