[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

confirmed (ZDI report on LKML Oct 21; AlmaLinux and CloudLinux/TuxCare reproduced root). No CVE or merged upstream fix yet; no in-the-wild exploitation reported

Linux local root with a public exploit: ZDI-CAN-33367 in skb_zerocopy() lets any user rewrite cached copies of read-only files, even on kernels with the Dirty Frag fix

Of the ZDI Linux reports that leaked to public lists on Oct 21, the lowest-rated one (ZDI-CAN-33367, CVSS 7.8, local privilege escalation) is the one that matters most right now. The report included a working proof-of-concept.

  • Bug: skb_zerocopy(), used by NFQUEUE and Open vSwitch, keeps file-backed pages in a packet but drops the SKBFL_SHARED_FRAG marker. IPsec ESP then decrypts in place over the kernel's page cache of a file the attacker can only read. This is the same primitive as Dirty Frag and Fragnesia (tampering with /usr/bin/su or /etc/passwd in memory), and kernels carrying the Dirty Frag fix (CVE-2026-43284) are still exposed.
  • Confirmed root: AlmaLinux 8, 9 and 10 are affected (AlmaLinux). CloudLinux/TuxCare report root on AlmaLinux 8-10, CloudLinux 9-10, Debian 12-13 and Ubuntu 24.04/26.04. Per THN, Sysdig found Ubuntu's AppArmor user-namespace restriction didn't stop it. CentOS 6/7 kernels aren't affected.
  • Requirements: a local unprivileged account plus unprivileged user namespaces (on by default on AlmaLinux) and standard networking modules.
  • Fix status: an upstream fix (Zizhen Liu, reviewed by Eric Dumazet) was posted to netdev Oct 22 but had not been merged as of Oct 24, and there is no CVE. AlmaLinux shipped backported kernels to its testing repo on Oct 23 (8: 4.18.0-553.177.2.el8_10, 9: 5.14.0-687.59.2.el9_8, 10: 6.12.0-211.68.2.el10_2), ahead of RHEL. KernelCare live patches are out for CloudLinux 10 and AlmaLinux 10.

Most exposed: multi-user hosts, shared hosting, CI runners and containers where untrusted code runs as an ordinary user. See the stopgaps.

Sources: AlmaLinux: ZDI-CAN-33367, patched kernels available in testing (Oct 23) · LKML: ZDI-CAN-33367 vulnerability report (Oct 21) · TuxCare/CloudLinux: leaked kernel reports include a root exploit that beats the Dirty Frag fix · The Hacker News: KSMBD flaws, update on ZDI-CAN-33367 public root exploit (updated Oct 26)