A public Linux exploit turns any local user into root on Ubuntu, Debian and AlmaLinux. Close the path now

A working root exploit for a Linux kernel bug went public last week before the bug had a CVE or a merged fix. Any local user on an affected machine can use it to change files they are only allowed to read, such as /usr/bin/su, and take over the system.

TuxCare reproduced a root shell on AlmaLinux 8, 9 and 10, CloudLinux 9 and 10, Debian 12 and 13, and Ubuntu 24.04 and 26.04. AlmaLinux has patched kernels in testing. Most other distributions are still waiting.

A public Linux exploit gets root on Ubuntu 24.04, Debian 12 and AlmaLinux 9 with no fixed kernel from most distros yet. Shared hosts and CI runners go first.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

A public Linux exploit gets root on Ubuntu, Debian and AlmaLinux

The bug, tracked by Trend Micro’s Zero Day Initiative as ZDI-CAN-33367 and rated 7.8, sits in the networking helper skb_zerocopy(). It drops a marker that tells the kernel’s IPsec code not to decrypt shared memory pages in place, so an attacker can overwrite the kernel’s cached copy of a read-only file. The marker came from this year’s fix for Dirty Frag (CVE-2026-43284), so kernels with that fix are still exposed.

ZDI sent the report to public kernel mailing lists on October 21 with working proof-of-concept code. An upstream fix by Zizhen Liu, reviewed by Eric Dumazet, was posted on October 22; Sysdig reported on Saturday that it was still not merged. AlmaLinux backported it ahead of Red Hat and put kernels for AlmaLinux 8, 9 and 10 in its testing repository on October 23. CloudLinux released a KernelCare live patch for CloudLinux 10 and AlmaLinux 10 the same day.

Shared Linux hosts where ordinary users can run code

This is a local flaw, so an attacker needs to run code on the machine first. That bar is low on shared web hosting, multi-user build servers, CI runners and any box where a compromised web app gives an attacker a shell. Ubuntu’s AppArmor limit on user namespaces did not stop the exploit; it launched through the profile of a container tool that is allowed to create them.

The change lives only in memory, AlmaLinux notes. The file on disk is untouched, so integrity checks against disk can miss it until the page cache is cleared or the system reboots.

Turn off unprivileged user namespaces where nothing needs them

• On hosts that do not need rootless containers or browser sandboxes for ordinary users, set user.max_user_namespaces=0 (on Debian, kernel.unprivileged_userns_clone=0). It applies without a reboot.
• On AlmaLinux, install the testing kernels (4.18.0-553.177.2.el8_10, 5.14.0-687.59.2.el9_8 or 6.12.0-211.68.2.el10_2) on a test host first, or wait for them to reach production.
• Where IPsec is not used, block the esp4 and esp6 modules, as AlmaLinux suggests, or the nlmon and act_pedit modules the public exploit needs.
• Watch your distribution’s security tracker and install the fixed kernel as soon as it ships.

Details

• Identifier: ZDI-CAN-33367, CVSS 7.8 (ZDI). No CVE yet; the kernel project assigns one after a stable-tree fix. Fix title: “net: skbuff: propagate shared-frag marker in skb_zerocopy()”.
• Root verified (TuxCare): AlmaLinux 8, 9, 10; CloudLinux 9, 10; Debian 12, 13; Ubuntu 24.04, 26.04. Not vulnerable: CentOS 6 and 7. Not yet tested: Ubuntu 22.04, CloudLinux 8, Oracle UEK and several cloud kernels.
• Exploit needs: unprivileged user namespaces plus the modules nlmon, nft_queue, nfnetlink_queue, cls_u32, act_pedit, act_mirred and esp4 (Sysdig).
• Same batch: two KSMBD flaws (ZDI-CAN-33774, ZDI-CAN-33549) affect only servers running the in-kernel SMB server; public code for them shows leaks and crashes, not code execution.

Hunt / verify

• Run sysctl user.max_user_namespaces; it prints 0 when the path is closed.
• Check which of the needed modules are loaded with lsmod | grep -E "nlmon|act_pedit|esp4|nfnetlink_queue". On most servers none of them should be.
• Sysdig says no exploitation in the wild had been reported as of Saturday. Alert on unprivileged processes creating user and network namespaces and then loading nlmon or adding XFRM state.

Source: AlmaLinux: patched kernels in testing; Sysdig: detection and mitigation

Sources

• TuxCare: Leaked Linux Kernel Reports Include Two ksmbd Bugs and a Root Exploit That Beats the Dirty Frag Fix
• AlmaLinux: ZDI-CAN-33367: Patched kernels available in testing
• Sysdig: Detecting and mitigating ZDI-CAN-33367 and five other Linux flaws
• The Hacker News: Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].