Skip to content

OSG-SEC-2026-11-05 IMPORTANT-ZDI-CAN-33367 Linux kernel local privilege escalation vulnerability

Dear OSG Security Contacts,

A Linux kernel local privilege escalation vulnerability, tracked by Trend Micro’s Zero Day Initiative (ZDI) as ZDI-CAN-33367, allows an unprivileged local user to alter the in-memory contents of files they can read but cannot write, potentially gaining root privileges. A working proof of concept (PoC) is publicly available. No CVE has been assigned as of November 5, 2026. ZDI rates the issue CVSS 7.8 High. [1][2][3]

IMPACTED VERSIONS:

The PoC has been confirmed on pre-fix kernels running AlmaLinux 8, 9, and 10; Debian 12 and 13; and Ubuntu 24.04 and 26.04. Other Linux distributions may also be affected; check the kernel advisory for your specific OS and release. [2][12] - AlmaLinux 8, 9, and 10: Fixed kernels are available. Install the vendor version or later: 4.18.0-553.178.1.el8_10, 5.14.0-687.60.1.el9_8, and 6.12.0-211.69.1.el10_2, respectively. [2] - RHEL 8: See RHSA-2026:93436 [9]. - RHEL 9: See RHSA-2026:93412 [11]. - RHEL 10.0 EUS: See RHSA-2026:94508 [10].

WHAT ARE THE VULNERABILITIES:

The flaw is in Linux kernel networking code, in skb_zerocopy(). Under the right conditions, an unprivileged local user can corrupt the page cache for a file they can read but lack permission to write. The PoC can use this to escalate privileges, potentially to root. An attacker must first be able to run code on the host; this is not a remote-only attack. [1][3]

ZDI-CAN-33367 is related to Dirty Frag and Fragnesia but uses a different kernel code path. Their kernel fixes alone do not fix this vulnerability. [2][5][6]

WHAT YOU SHOULD DO:

Install the vendor-fixed kernel and reboot affected hosts. Verify that the fixed kernel is running after reboot.

If patching is delayed and the host does not rely on IPsec, blocking and unloading esp4 and esp6 blocks the published PoC path. If the earlier Dirty Frag or Fragnesia module mitigation is still active and both modules are blocked and not loaded, it also covers this PoC. [2][8]

sudo sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\n' \

            >/etc/modprobe.d/dirtyfrag.conf"

sudo rmmod esp4 esp6 2>/dev/null; true

lsmod | grep -E 'esp4|esp6'

No output from the last command means neither module appears loaded. If either module remains listed, it may still be in use and the mitigation is not active. Blocking these modules prevents IPsec ESP from working while the block is in place. [8]

Disabling unprivileged user namespaces with user.max_user_namespaces=0 is another possible mitigation. [7] However, that can disrupt rootless containers and some unprivileged Apptainer workflows, so assess job impact before applying. Alternatively, disabling network namespaces should also block the PoC, although that can disrupt other functions. [13]

REFERENCES

[1] https://lore.kernel.org/lkml/BYAPR01MB3830CECF5D0871064C59BA0280662@BYAPR01MB3830.prod.exchangelabs.com/
[2] https://almalinux.org/blog/2026-10-23-zdi-can-33367/.
[3] https://bugzilla.redhat.com/show_bug.cgi?id=2559835.
[4] https://access.redhat.com/security/vulnerabilities/RHSB-2026-014.
[5] https://almalinux.org/blog/2026-05-07-dirty-frag/.
[6] https://almalinux.org/blog/2026-05-13-fragnesia-cve-2026-46300/.
[7] https://blog.cloudlinux.com/?p=266368.
[8] https://access.redhat.com/security/vulnerabilities/RHSB-2026-003.
[9] https://access.redhat.com/errata/RHSA-2026:93436.
[10] https://access.redhat.com/errata/RHSA-2026:94508
[11] https://access.redhat.com/errata/RHSA-2026:93412.
[12] https://tuxcare.com/blog/zdi-ksmbd-bugs-cve/?utm_term=zdi-can-33367&utm_campaign=s+%7C+ZDI+skb_zerocopy+blog+post.
[13] https://apptainer.org/docs/admin/latest/user_namespace.html#disabling-network-namespaces.

Please contact the OSG security team at [email protected] if you have any questions or concerns. OSG Security Team