AlmaLinux patches ZDI-CAN-33367 kernel bug ahead of RHEL, ships to testing

A new Linux kernel vulnerability tracked as ZDI-CAN-33367 allows unprivileged local users to corrupt read-only files through the page cache by exploiting a missing marker in skb_zerocopy(). The flaw, similar to Dirty Frag and Fragnesia, has a CVSS score of 7.8. AlmaLinux's technical steering committee ALESCo decided to ship patched kernels ahead of upstream RHEL due to the public availability of a working proof-of-concept. Patched kernels are now in AlmaLinux's testing repository for versions 8, 9, and 10.

How the skb_zerocopy() bug corrupts file pages

• Root cause: skb_zerocopy() keeps file pages attached via splice(2) but drops the SKBFL_SHARED_FRAG marker that warns IPsec ESP not to decrypt in place
• Exploit path: Attacker uses NFQUEUE or Open vSwitch to trigger skb_zerocopy(), then ESP decrypts over the cached file pages, modifying memory contents of read-only files
• Same primitive as Dirty Frag/Fragnesia: Fragnesia hit the same bug in skb_try_coalesce(); this is a different code path to the same outcome
• Unprivileged exploitation: Proof-of-concept runs as ordinary user via unprivileged user namespaces, which AlmaLinux enables by default
• Backport complexity: AlmaLinux 8 required adaptation for older socket-buffer code; fix written by Zizhen Liu, reviewed by Eric Dumazet
• No CVE assigned yet; vulnerability disclosed to kernel mailing lists on 2026-10-21, fix posted to netdev on 2026-10-22

Why it matters

AlmaLinux shipping ahead of RHEL is notable for a RHEL-compatible distribution that normally tracks upstream closely. The decision by ALESCo to bypass the usual CentOS Stream/RHEL pipeline reflects both the severity of the bug and the project's growing operational independence. Multi-tenant hosts, CI runners, and container build farms are the primary at-risk environments.