ZDI-CAN-33367 — Linux Kernel Local Root Flaw: Check, Mitigate & Patch

Made public on 20–21 October 2026, with a working exploit. ZDI-CAN-33367 is a flaw in the Linux kernel's networking code (no CVE number has been assigned yet). Any ordinary user with a shell on the server, such as a hosting account or an attacker who got into one site through a vulnerable plugin, can rewrite files they should only be able to read, and from there become root. It cannot be exploited from outside the server. Fixed kernels and KernelCare livepatches are now available for CloudLinux and AlmaLinux.

CageFS does not protect against this one. The flaw is inside the shared kernel, not in the file system, so caging an account does not stop it.

Am I exposed? One-line check

Exposure depends on one setting: whether ordinary users are allowed to create their own namespaces. Run as root:

• 0: the attack path is closed for ordinary accounts. Still install the fixed kernel (Step 2) when you can.
• Any other number: treat the server as exposed until you apply Step 1 or Step 2.

What you can expect to see:

The setting decides, not the version: an administrator or container software may have changed it, so always run the check on the server itself.

If the check printed anything other than 0, switch off unprivileged user namespaces:

echo 'user.max_user_namespaces = 0' > /etc/sysctl.d/99-zdi-33367.conf
sysctl --system

Run the check again. It must now print 0.

Side effect: ordinary users can no longer run rootless containers (rootless Podman or Docker, unprivileged LXC, Flatpak and some browser sandboxes). On a normal shared-hosting server this costs nothing. To undo it later, delete

/etc/sysctl.d/99-zdi-33367.conf

With KernelCare (no reboot)

kcarectl --update
kcarectl --patch-info | grep -i 33367

A line mentioning 33367 means the livepatch is active on the running kernel. No output means there is no livepatch for your kernel yet: keep Step 1 in place and try again later. Use --patch-info, not --info; --info never lists individual fixes, so it makes a patched server look unpatched.

Livepatches are released for CloudLinux 7 hybrid, 8, 9 and 10, and for CloudLinux for Ubuntu 22.04. CloudLinux 9 ELS is still in preparation, and CloudLinux 8 ELS has no livepatch, so it needs the kernel update below.

Without KernelCare: kernel update and reboot

On CloudLinux and AlmaLinux:

yum clean metadata
yum update
reboot

After the reboot, uname -r should show this build or a later one:

If

yum update

Debian / Ubuntu: install your distribution's latest kernel security update and reboot. Keep Step 1 in place until then.

If a licence shows as inactive after the reboot

Refresh it:

tslzCP

Use

tslzCLN

tslzLSWS

Also fixed by the same update: BadGarbage (CVE-2026-53361) on EL10

If you run CloudLinux 10 or AlmaLinux / Rocky Linux / RHEL / Oracle Linux 10, an earlier kernel flaw nicknamed BadGarbage (CVE-2026-53361, CVSS 7.0, public proof-of-concept) also lets any local user, even one inside a container, become root. There is no setting that switches it off: only a fixed kernel or the KernelCare livepatch closes it.

• CloudLinux 10 / AlmaLinux 10: kernel 6.12.0-211.47.1.el10_2 or later fixes it. The 10.x kernel in the table above is newer, so installing it fixes both flaws.
• Rocky Linux, RHEL and Oracle Linux 10: install your distribution's latest kernel and reboot.
• KernelCare check: kcarectl --patch-info | grep CVE-2026-53361

Systems on version 7, 8 or 9 are not affected by BadGarbage.

KernelCare

KernelCare applies kernel security fixes without a reboot, and it comes with CloudLinux licences from us (see TuxCare ELS + KernelCare). To see whether it is running on your server:

If the command is not found, open a ticket and we'll check it for you.

Managed-service customers

If your server is under one of our Server Management plans, we apply these fixes for you. Open a ticket if you'd like confirmation for your server. Not on a plan and would rather we did it? Open a ticket, share access, and we'll apply the mitigation, install the fixed kernel in a maintenance window that suits you, and verify it.