Public Linux Root Exploit Emerges Before Mainline Fix; AlmaLinux Offers Test Kernels

A public exploit for Linux kernel vulnerability ZDI-CAN-33367 can give an unprivileged local user root access, with successful exploitation reported on AlmaLinux, Debian and Ubuntu. The CVSS 7.8 flaw allows corruption of cached contents of files the attacker can read but cannot write: a lost shared-page marker in the kernel’s networking code permits IPsec ESP decryption to overwrite file-backed pages. The exploit was published on October 21 before a CVE identifier or merged upstream fix was available. Trend Micro’s Zero Day Initiative disclosed the vulnerability alongside five others, including two CVSS 9.0 remote-code-execution flaws in the ksmbd SMB server, one requiring no authentication.

AlmaLinux released patched kernels for versions 8, 9 and 10 in its testing repository on October 23, ahead of an available RHEL kernel fix, and recommends installing a patched kernel and rebooting. Blocking and unloading the ESP modules can mitigate the published exploit but disrupts IPsec workloads. Restrictions on unprivileged user namespaces may also block the exploit, although Sysdig cautioned about operational limitations and incomplete validation. Organizations should prioritize affected systems by deployed components, restrict unnecessary SMB access and assess available kernel fixes. Sysdig reported no known in-the-wild exploitation as of its October 24 analysis, but several disclosed vulnerabilities remained unpatched in released kernels.