ZDI discloses six Linux kernel flaws with no CVEs, one already has a public root exploit

The Zero Day Initiative sent six Linux kernel vulnerability reports to maintainers on October 20–21, 2026, and none has a CVE identifier yet. ZDI-CAN-33367, a local privilege escalation in the networking stack rated 7.8, already has a public exploit that TuxCare used to get root on AlmaLinux 8–10, Debian 12–13 and Ubuntu 24.04/26.04.

• ZDI-CAN-33367: networking LPE rated 7.8, public exploit yields root
• ZDI-CAN-33774 and 33549: ksmbd flaws rated 9.0, pre-auth memory leak and SMB Direct path
• ZDI-CAN-34068: LPE rated 8.8 in VMware graphics driver, no patch yet
• Blocking unprivileged user namespaces stops the exploit but breaks rootless containers