Kernel Root Zero Day - zdi-can-33367

[nathany]

ZDI-CAN-33367: Linux Kernel Local Root Zero-Day, Mitigation for CloudLinux - CloudLinux

📋 TL;DR: last updated 26 October 2026 ZDI-CAN-33367 (no CVE assigned) is a flaw in the Linux kernel networking stack that lets any local user rewrite files they can only read, which leads to root. A public exploit exists. Fixed kernels for CloudLinux 7 hybrid and 8 are in beta and rolling out...

blog.cloudlinux.com

 

[ccto]

There are some temporary mitigation:
ref.: https://almalinux.org/blog/2026-10-23-zdi-can-33367/

 

[zEitEr]

Patched kernels are already in regular repositories for Alma 8-9:

• AlmaLinux 8: kernel-4.18.0-553.179.1.el8_10
• AlmaLinux 9: kernel-5.14.0-687.61.1.el9_8

The Alma10 is still 6.12.0-211.68.1.el10_2.x86_64, it is missing kernel-6.12.0-211.68.2.el10_2

 

[zEitEr]

There are some temporary mitigation:

If to follow the temporary mitigation by the way, i.e. setting 'user.max_user_namespaces=0', you might break Jailshell in DirectAdmin. It might bring to the following errors:

[root@poralix]# su - username
Last login: Tue Feb 17 00:15:00 CET 2026 on pts/4
bwrap: Creating new namespace failed: No space left on device
[root@poralix]#

crontasks will break as well.