Hello debian-kernel, I am writing to report an independent reproduction of the Linux kernel local privilege escalation tracked as ZDI-CAN-33367 on a standard Debian 13 (trixie) installation, with details specific to the trixie kernel series.
Vulnerability summary skb_zerocopy() in net/core/skbuff.c does not propagate the SKBFL_SHARED_FRAG ownership flag when copying fragments. An ESP (IPsec) receive path that calls skb_cow_data() on such an skb performs in-place AES-CBC decryption directly into the page-cache page of a root-owned, read-only file, allowing an unprivileged local user to overwrite arbitrary bytes of files they can read but not write. Original public report (2026-10-21): https://lore.kernel.org/lkml/byapr01mb3830cecf5d0871064c59ba0280...@byapr01mb3830.prod.exchangelabs.com/ Upstream fix (2026-10-22): https://lists.openwall.net/netdev/2026/10/22/204 Tested environment OS: Debian GNU/Linux 13 (trixie) Kernel: 6.12.113+deb13-amd64 libpam-modules: 1.7.0-5 Filesystem: ext4 AppArmor: active, process context unconfined Reproduction A freshly created unprivileged user (uid=1002, single primary group, no supplementary groups) with no special configuration achieved root via a splice()+NFQUEUE+TC pedit+ESP chain that overwrites bytes of /usr/lib/x86_64-linux-gnu/security/pam_rootok.so in page cache, patching out the getuid() check. Afterwards su succeeds without a password: $ id uid=1002(testlpe) gid=1002(testlpe) groups=1002(testlpe) $ ./zerofrag PROFILE_ID=debian13 MUTATE before=5013000000000000 after=1015000000000000 TRIGGER changed=1 guards_ok=1 target_exact=1 caps=zero no_new_privs=1 LPE_RESULT=PASS FINAL_RESULT=PASS $ su -c id uid=0(root) gid=0(root) groups=0(root) The mutation is page-cache-only; the on-disk file is untouched and restored by posix_fadvise(POSIX_FADV_DONTNEED) or reboot. Notes specific to trixie Compared to other reported environments, trixie required the following to match correctly: - AppArmor is active on trixie (present in /sys/kernel/security/lsm), process context is unconfined — constraint must be matched as apparmor:unconfined, not none - Default trixie users are added to many system groups (cdrom, audio, video, etc.) — supplementary group checking must not be treated as a match failure for standard desktop users - Kernel 6.12.113+deb13-amd64 is affected; the fix from netdev has not been backported as of 2026-10-30 Suggested action Cherry-pick the upstream patch into the trixie (and bookworm-security if applicable) kernel series: "net: skbuff: propagate shared-frag marker in skb_zerocopy()" https://lists.openwall.net/netdev/2026/10/22/204 Author: Zizhen Liu <[email protected]> Reviewed-by: Eric Dumazet <[email protected]> AlmaLinux has already shipped patched kernels as of 2026-10-28 as a reference. Temporary mitigation install esp4 /bin/true install esp6 /bin/true Disables the vulnerable ESP receive path; IPsec will not function while active. References [1] Original LKML report https://lore.kernel.org/lkml/byapr01mb3830cecf5d0871064c59ba0280...@byapr01mb3830.prod.exchangelabs.com/ [2] Upstream fix https://lists.openwall.net/netdev/2026/10/22/204 [3] AlmaLinux advisory https://almalinux.org/blog/2026-10-23-zdi-can-33367/ [4] Public PoC https://github.com/FranklinF25/zdi-can-33367 I am happy to provide additional technical details or test patched packages. Regards, Alex Borman
