---
title: Tip: until kernels ship a fix for ZDI-CAN-33367, close the unprivileged-namespace path or unload IPsec ESP on hosts that don't need it | ctxsec
url: https://ctxsec.com/items/tip-linux-skb-zerocopy-stopgaps-userns-esp
description: ""
status: "tip based on AlmaLinux and CloudLinux/TuxCare guidance for ZDI-CAN-33367"
published: 2026-10-26
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-linux-skb-zerocopy-stopgaps-userns-esp.md)

tip based on AlmaLinux and CloudLinux/TuxCare guidance for ZDI-CAN-33367

2026-10-26

### Tip: until kernels ship a fix for ZDI-CAN-33367, close the unprivileged-namespace path or unload IPsec ESP on hosts that don't need it

- Check exposure: `sysctl user.max_user_namespaces` (non-zero means the exploit path is open) and `lsmod | grep -E "esp4|esp6"`.
- If ordinary users don't need rootless containers, Flatpak or browser sandboxes: `sysctl -w user.max_user_namespaces=0` and persist it in `/etc/sysctl.d/`. CloudLinux notes it had not yet tested this against the exploit, so treat it as risk reduction.
- If the host doesn't use IPsec: block the ESP modules (AlmaLinux's stopgap), e.g. `install esp4 /bin/false` and `install esp6 /bin/false` in `/etc/modprobe.d/`, then reboot or unload them.
- On AlmaLinux, test the kernels from the testing repo now. Elsewhere, watch for your distro's fixed kernel and reboot into it. The page-cache tampering survives until the cache is evicted or the system reboots.
- Prioritize shared hosting, CI runners, jump hosts and container nodes where untrusted users or code run locally.

Sources: [AlmaLinux: ZDI-CAN-33367, patched kernels available in testing (Oct 23)](https://almalinux.org/blog/2026-10-23-zdi-can-33367/) · [TuxCare/CloudLinux: leaked kernel reports include a root exploit that beats the Dirty Frag fix](https://tuxcare.com/blog/zdi-ksmbd-bugs-cve/)