ZDI-CAN-33367: when an avoided copy writes into a read-only file
On 20 October 2026, a Zero Day Initiative report meant for the Linux kernel security team was mistakenly sent to public mailing lists. It described a local privilege escalation, registered as ZDI-CAN-33367, and a demonstration program circulated soon after. Ten days later, the flaw still has no CVE number, the proposed fix isn’t merged into…