Detecting and mitigating ZDI-CAN-33367 and five other Linux flaws

Security researchers disclosed six Linux-related flaws publicly before CVE assignments or broadly available fixes, including ZDI-CAN-33367, a kernel local privilege-escalation bug with a public proof of concept that can yield root access on tested Ubuntu, Debian, AlmaLinux, and other distributions. The flaw bypasses earlier Dirty Frag protections because the skb_zerocopy() networking path fails to preserve a marker that prevents unsafe in-place writes to page-cache-backed files; a reviewed patch exists but had not yet been merged at publication. Two CVSS 9.0 vulnerabilities affect only systems running ksmbd, Linux’s in-kernel SMB server rather than Samba: one allows pre-authentication memory disclosure and crashes through a protocol-dispatch race, while the other is a potential RDMA-based heap overflow requiring SMB Direct and a writable share. Other reported issues include a VMware guest-only vmwgfx privilege-escalation vulnerability without a patch, an nvmet information leak with limited public details, and an out-of-scope ConnMan DNS proxy stack overflow. Recommended defenses include promptly applying distribution patches, restricting unprivileged user namespaces and relevant networking modules where operationally feasible, enforcing Kubernetes RuntimeDefault seccomp profiles, identifying and disabling unnecessary ksmbd or SMB Direct deployments, restricting TCP port 445, and monitoring VMware guests using vmwgfx.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.