Public exploit released for Linux kernel local privilege escalation flaw

A working proof-of-concept exploit for a local privilege escalation vulnerability in the Linux kernel has been released to the public. The flaw, identified as ZDI-CAN-33367, was discovered by TrendAI's Zero Day Initiative and involves the ConnMan network manager and the Linux network stack.

Security researchers at TuxCare successfully reproduced a root shell using this exploit on several major distributions, including AlmaLinux (8, 9, 10), Debian (12, 13), and Ubuntu (24.04, 26.04). This disclosure occurred before a formal CVE identifier or a universal upstream fix had been widely deployed, increasing the immediate risk to unpatched systems.

Vulnerability details and technical impact

• Vulnerability Type: The primary flaw (ZDI-CAN-33367) is a local privilege escalation within the Linux network stack with a CVSS score of 7.5.
• Exploit Scope: The exploit was verified to grant root access on multiple stable distributions including Debian, Ubuntu, and AlmaLinux.
• SMB Server Flaws: Two additional vulnerabilities in the kernel's Server Message Block (SMB) server were reported, carrying CVSS scores of 9.0 and 10.0, which can lead to memory leaks or remote code execution.
• Mitigation Strategy: Administrators are advised to prioritize fixes based on actual usage and are encouraged to unload the KSMBD module if it is not required for system operations.

Why it matters

Why it matters: The release of a working exploit before a patch is available significantly shortens the window for system administrators to secure their environments. Users of Debian, Ubuntu, and AlmaLinux should monitor for kernel updates immediately, and those running SMB servers should evaluate the necessity of the KSMBD module to reduce their attack surface.