A series of vulnerabilities have been identified in the Linux and FreeBSD kernels. Vulnerabilities in Linux make it possible to remotely execute code, elevate your privileges in the system, exit containers, or bypass the isolation of virtual machines. Vulnerabilities in FreeBSD allow you to remotely stop the kernel, elevate your system privileges, and bypass the isolation of the Bhyve hypervisor.
Vulnerabilities in the Linux kernel:
- 5 vulnerabilities disclosed by the Zero Day Initiative before patches were published due to erroneous sending information to the wrong mailing list:
- ZDI-CAN-33549 – a vulnerability in the ksmbd module with the implementation of a file server based on the SMB protocol, which can be exploited for remote code execution at the kernel level. The problem is caused by an integer overflow in the mbdirect_connection_rdma_xmit() function, which occurs if the kernel is built with the “CONFIG_SMB_SERVER_SMBDIRECT=y” and “CONFIG_RDMA_RXE=y” options. For a successful attack, the attacker must be able to write to shared storage provided by the attacked server, which must also use RDMA and SMB Direct technologies. An exploit prototype is available that works on Debian 13.
- ZDI-CAN-33774 – race condition in ksmbd kernel module, resulting in 62 bytes of data from the SMB2 header being written to the 40-byte buffer allocated for the SMB1 protocol. The vulnerability can lead to remote code execution if there is access to SMB storage processed through ksmbd. An exploit prototype is available that works in Debian 13.
- ZDI-CAN-33367 – vulnerability in kernel network stack, allowing a local user to gain root rights in the system by overwriting process data in the page cache, similar to the Dirty Frag and Fragnesia vulnerabilities. This time the problem is caused by a bug in the function
skb_zerocopy(). An exploit prototype has been prepared that works in different versions of Ubuntu. The fix is available as a patch. Of the distributions, so far only the Alma Linux developers formed an unscheduled update of kernel packages that fixed this vulnerability. - ZDI-CAN-34068 – buffer overflow in the VMWGFX graphics driver used for implementation 3D acceleration in VMware environments. The issue allows a local user to gain root privileges on the system while having access to the virtual GPU via the /dri/card* device. An exploit prototype is available that works on Ubuntu 26.04
/Reports, release notes, official announcements.