Security News

Public Root Exploit for Linux Kernel Flaw Lands Before a Fix Is Available

Infosecurity Magazine · 27 Oct 2026

Key Takeaway Check which Linux components your servers actually run, disable ksmbd if unused, limit port 445 to trusted networks, and apply kernel updates as soon as your distribution releases them.

A working exploit for a Linux kernel flaw has been published before the bug received a CVE identifier or a merged upstream fix. Trend Micro's Zero Day Initiative (ZDI) sent six reports to maintainers and public mailing lists on October 20 and 21, according to analysis from the Sysdig Threat Research Team published on October 24. No attacks in the wild had been reported at that point, but several of the flaws still had no fix in any released kernel.

The most urgent is ZDI-CAN-33367, a local privilege escalation bug in the Linux networking stack, scored 7.8. It can let an unprivileged user change the in-memory contents of files they can only read. TuxCare reproduced a root shell using the public proof of concept on AlmaLinux, CloudLinux, Debian and Ubuntu releases. Sysdig said restricting unprivileged user namespaces should block it, though this was not validated and rootless containers depend on them. AlmaLinux had patched kernels in testing, but not production, by October 23.

The other five include two rated 9.0 in ksmbd, the kernel's SMB server. One is a remote, pre-authentication bug that can leak kernel memory and crash systems. There is also an 8.8 flaw in the VMware graphics driver with no patch, plus issues in the NVMe target and the ConnMan network manager. Sysdig advised prioritising by the components you run, unloading ksmbd where it is not needed, and restricting port 445 to trusted networks.

Linux Kernel vulnerability Privilege escalation Patch management

Summarised by CISO AI from Infosecurity Magazine, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.