Six Linux kernel reports, one public root exploit, and no CVE to track them by
Six Linux kernel reports, one public root exploit, and no CVE to track them by The Zero Day Initiative sent six kernel vulnerability reports to maintainers and public mailing lists on October 20 and 21, 2026. By the time Sysdig's Threat Research Team analysed them on October 24, one of the six already had a working public proof of concept, and several had no fix in any released kernel. None of…
On October 20 and 21, 2026, the Zero Day Initiative provided six Linux kernel vulnerability reports to maintainers and public mailing lists. By October 24, Sysdig's Threat Research Team found that one of the six had a working public proof of concept and several lacked a fix in released kernels. Notably, none of the vulnerabilities had a CVE identifier yet.
The most significant flaw is a local privilege escalation in the Linux networking stack, rated 7.8 by ZDI, which allows an unprivileged user to alter the in-memory contents of files they can only read. Another high-rated issue, ZDI-CAN-33774, concerns ksmbd, the in-kernel SMB server, and can leak kernel memory and crash systems.
The remaining three ZDI reports represent different categories: one is a local privilege escalation with no patch, another is an information leak in the NVMe target, and the last is a userspace stack overflow in the ConnMan network manager. Because there are no CVE identifiers, Sysdig recommends prioritizing based on the components a fleet actually runs rather than CVSS scores.
This approach provides a more accurate assessment of the risk and the exposure of the fleet to the vulnerabilities.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
