Detecting and mitigating ZDI-CAN-33367 and five other Linux flaws

A working root exploit for a Linux kernel bug is now public, before it has a CVE or a merged fix. On October 20, 2026, Trend Micro’s Zero Day Initiative (ZDI) sent one report, a bug in the ConnMan network manager, to the public ConnMan mailing list. On October 21, ZDI sent five reports to the Linux kernel security team and copied public mailing lists on every one. The reports included reproduction details, showing that several had no patch attached and no fix in any released kernel. Two of the Linux flaws have been rated as CVSS 9.0. None of the six bugs has been assigned a CVE ID yet, and no in-the-wild exploitation has been reported as of the publication of this blog. However, security teams should work to get detections and mitigations in place now. TuxCare has reproduced the public proof of concept (PoC) for ZDI-CAN-33367 from the ZDI report. Exploitation leads to root access on current Ubuntu, Debian, and AlmaLinux distributions. The Sysdig Threat Research Team (TRT) reviewed the batch of Linux vulnerabilities and ranked the reports by how much each should affect what defenders…