The Zero Day Initiative sent six kernel vulnerability reports to maintainers and public mailing lists on October 20 and 21, 2026. By the time Sysdig's Threat Research Team analysed them on October 24, one of the six already had a working public proof of concept, and several had no fix in any released kernel. None of them had a CVE identifier yet.
That combination is the hard case for a patching programme. A CVE gives an asset owner a handle: a feed entry, a scanner signature, a vendor advisory page and a fixed version. Without one, the same information arrives as a mailing-list thread with a ZDI candidate number and a description of the component affected.
ZDI-CAN-33367 is a local privilege escalation in the Linux networking stack, rated 7.8 by ZDI. An unprivileged user can alter the in-memory contents of files they can only read. The code path is one that the kernel's earlier fix for the Dirty Frag page-cache flaws did not cover, which matters when you are reasoning about which kernels are actually protected: a distribution that backported the Dirty Frag fix has not automatically addressed this one.
TuxCare reproduced a root shell with the public proof of concept on AlmaLinux 8 through 10, CloudLinux 9 and 10, Debian 12 and 13, and Ubuntu 24.04 and 26.04. That distribution list is the useful part of the report, because it describes the population at risk in terms a fleet owner can check rather than in terms of upstream kernel versions.
Sysdig suggested that restricting unprivileged user namespaces should block the public exploit, and noted that TuxCare had not validated that mitigation. It also noted the dependency in the other direction: rootless containers rely on unprivileged user namespaces. A control that closes this path also breaks a deployment pattern many teams have standardised on.
The two highest-rated reports, ZDI-CAN-33774 and ZDI-CAN-33549, both score 9.0 and both concern ksmbd, the in-kernel SMB server. The first is remote and pre-authentication, and can leak kernel memory and crash systems. The second requires SMB Direct, an RDMA interface and a writable share, which is a much narrower precondition.
A pre-authentication memory leak in an in-kernel SMB server is the kind of finding that deserves attention beyond its CVSS score, because the reachable surface is port 445. Sysdig's guidance is proportionate: unload ksmbd where it is not needed, and restrict port 445 to trusted networks where it must stay.
ZDI-CAN-34068 is a local privilege escalation rated 8.8 in the kernel's VMware graphics driver. At the time of the analysis there was no patch and only the report's title was public, which puts it in a different category: the flaw is real, the details are not available, and there is nothing to test against.
ZDI-CAN-34076 is an information leak in the NVMe target, and ZDI-CAN-32005 is a userspace stack overflow in the ConnMan network manager. Neither is in the kernel proper, which changes who owns the fix.
Sysdig's advice is to prioritise by the components a fleet actually runs rather than by score. That is the only workable approach when the identifiers are missing, and it produces a different order from a CVSS sort.
A fleet that does not load ksmbd has no exposure to the two 9.0 findings, regardless of their rating. A fleet running containers on a kernel with unprivileged user namespaces enabled has exposure to the 7.8 finding with a public exploit, regardless of its lower score. The component inventory is doing the ranking work that the missing CVE would otherwise do.
The patch status adds a second dimension that a CVE feed normally hides. AlmaLinux had kernels in testing but not in production as of October 23. A fleet on that distribution is in the window between disclosure and a production package, and a scanner keyed to fixed versions would report it as unaffected until the package landed.
ZDI candidate numbers are the only stable handle available before CVE assignment, so they belong in the ticket. Recording the component, the distribution test results and the mitigation that was chosen gives the record enough to match later, when a CVE appears and the advisory references it retroactively.
The public exploit and the root shell are the reason this report is not a waiting game. ZDI-CAN-33367 is testable today on the distributions listed, and a kernel that fails the test is a kernel that needs the fix.
[1] Infosecurity Magazine, "Linux Flaws Exposed Before Fixes as Root Exploit Goes Public", October 26, 2026. https://www.infosecurity-magazine.com/news/linux-flaws-exposed-before-fixes/