# AlmaLinux patches ZDI-CAN-33367 kernel bug ahead of RHEL, ships to testing

> **Key takeaway:** AlmaLinux has backported a fix for a high-severity local privilege escalation vulnerability (ZDI-CAN-33367) to all supported releases and made patched kernels available in its testing repository before RHEL has shipped its own fix.

**Published:** 2026-10-23T00:00:00+00:00 
**Source:** AlmaLinux Blog 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/almalinux-patches-zdi-can-33367-kernel-bug-ahead-of-rhel-shi.html 

## Summary
A new Linux kernel vulnerability tracked as ZDI-CAN-33367 allows unprivileged local users to corrupt read-only files through the page cache by exploiting a missing marker in skb_zerocopy(). The flaw, similar to Dirty Frag and Fragnesia, has a CVSS score of 7.8. AlmaLinux's technical steering committee ALESCo decided to ship patched kernels ahead of upstream RHEL due to the public availability of a working proof-of-concept. Patched kernels are now in AlmaLinux's testing repository for versions 8, 9, and 10.

## How the skb_zerocopy() bug corrupts file pages
- **Root cause**: `skb_zerocopy()` keeps file pages attached via `splice(2)` but drops the `SKBFL_SHARED_FRAG` marker that warns IPsec ESP not to decrypt in place
- **Exploit path**: Attacker uses NFQUEUE or Open vSwitch to trigger `skb_zerocopy()`, then ESP decrypts over the cached file pages, modifying memory contents of read-only files
- **Same primitive as Dirty Frag/Fragnesia**: Fragnesia hit the same bug in `skb_try_coalesce()`; this is a different code path to the same outcome
- **Unprivileged exploitation**: Proof-of-concept runs as ordinary user via unprivileged user namespaces, which AlmaLinux enables by default
- **Backport complexity**: AlmaLinux 8 required adaptation for older socket-buffer code; fix written by Zizhen Liu, reviewed by Eric Dumazet
- **No CVE assigned yet**; vulnerability disclosed to kernel mailing lists on 2026-10-21, fix posted to netdev on 2026-10-22

## Why it matters
AlmaLinux shipping ahead of RHEL is notable for a RHEL-compatible distribution that normally tracks upstream closely. The decision by ALESCo to bypass the usual CentOS Stream/RHEL pipeline reflects both the severity of the bug and the project's growing operational independence. Multi-tenant hosts, CI runners, and container build farms are the primary at-risk environments.