ZDI-CAN-33367: Patched kernels available in testing

The vulnerability, tracked by Trend Micro's Zero Day Initiative as ZDI-CAN-33367, was reported on 2026-10-21 and affects all supported AlmaLinux releases (8, 9, and 10). It allows an unprivileged local user to modify contents of files they can read but not write, such as root-owned files, by corrupting the kernel's in-memory copy of those files.

ZDI classifies this as a local privilege escalation with a CVSS score of 7.8 (High). The vulnerability is similar to previously discovered flaws Dirty Frag and Fragnesia, affecting a different path in the kernel's networking code. A working proof-of-concept has been made public alongside the vulnerability report.

Technical Details

The bug exists in the skb_zerocopy() function, which is used by NFQUEUE and Open vSwitch to move packet data between buffers. When a network packet carries pages the kernel doesn't own—such as file pages attached with splice(2)—the kernel marks it with SKBFL_SHARED_FRAG. However, skb_zerocopy() was keeping the file pages while dropping this marker, allowing IPsec ESP to decrypt in place and write directly over cached pages of files an attacker could only read.

Patched Versions Available

AlmaLinux has backported the fix to every supported branch, creating patched kernels available in the testing repository. The versions are: kernel-4.18.0-553.177.2.el8_10 for AlmaLinux 8, kernel-5.14.0-687.59.2.el9_8 for AlmaLinux 9, and kernel-6.12.0-211.68.2.el10_2 for AlmaLinux 10. AlmaLinux Kitten 10 will receive the fix in the next regular kernel update.

The decision to ship ahead of CentOS Stream/RHEL updates was made by the AlmaLinux technical steering committee (ALESCo). Users can install the patched kernels by enabling the testing repository, updating the kernel packages, and rebooting. The testing repository can be disabled afterward if desired.

Temporary Mitigation

For systems that cannot reboot immediately, a temporary mitigation involves blocking the esp4 and esp6 modules, which the proof-of-concept uses to write into the page cache. This can be done by creating a modprobe configuration that prevents these modules from loading and unloading them if already present. However, this mitigation will break IPsec functionality and should only be used as a temporary measure.

If a system may have been compromised before applying mitigation, administrators can drop the page cache to evict any tampered pages. The most reliable solution remains installing the patched kernel and rebooting. AlmaLinux will update the community when the patched kernels move from testing to production repositories.