cyberresearch.us

TLP:CLEAR confidence:medium · #cyber-news #emerging

ZDI-26-577: Trend Micro VPN OpenSSL Configuration Uncontrolled Search Path Element Local

Luke Johnson / Cyber Research US

Summary

This memo synthesizes public Zero Day Initiative advisories dated 13 August 2026. Four Linux Kernel net-scheduler issues (use-after-free and locking races) and one unrelated Trend Micro VPN OpenSSL search-path issue are disclosed as local privilege-escalation bugs; vendors issued fixes. No source claims in-the-wild exploitation, public PoCs, or confirmed victims. This is a synthesis of those advisories, not independent reverse engineering.

Attack vector

All five issues are local only (ZDI). No remote protocol, unauthenticated network exposure, or user-interaction requirement is described.

  • Linux Kernel (ZDI-26-571 / CVE-2026-64530): attacker must already execute low-privileged code on the host, then reach the net-scheduler packet-classifier path that calls tcf_qevent_handle (ZDI). CVSS vector is AV:L/AC:L/PR:L/UI:N/S:C.
  • Linux Kernel (ZDI-26-574 / CVE-2026-46319; ZDI-26-568; ZDI-26-569): attacker must already execute high-privileged code, then operate on net-scheduler objects (tcf_ct_flow_table, tcf_tunnel_key_params, or qdisc / True Link Equalizer handling). CVSS vectors are AV:L/AC:H/PR:H/UI:N/S:C (ZDI). How userspace obtains that scheduler surface is not specified beyond those object/function names.
  • Trend Micro VPN (ZDI-26-577 / CVE-2026-67212): attacker must already execute low-privileged code on a host with Trend Micro VPN installed; the product’s OpenSSL configuration is loaded from an unsecured location (ZDI). CVSS is AV:L/AC:H/PR:L/UI:N/S:U.

Exploit

No chain stages, tooling, or PoC steps are published. Bug classes and failure points as stated:

  • ZDI-26-571: use-after-free in tcf_qevent_handle from not validating that an object still exists before operating on it; claimed result is arbitrary code in kernel context (ZDI).
  • ZDI-26-574: race from missing locking on tcf_ct_flow_table objects; claimed kernel-context code execution (ZDI).
  • ZDI-26-568: race from missing locking on tcf_tunnel_key_params objects; claimed kernel-context code execution (ZDI).
  • ZDI-26-569: race from missing locking when handling qdisc objects (True Link Equalizer path); claimed kernel-context code execution (ZDI).
  • ZDI-26-577: uncontrolled search-path / insecure OpenSSL config load; claimed arbitrary code as SYSTEM (ZDI).

In the wild / novelty

Not stated. These are coordinated ZDI disclosures (reported to vendors between 2026-03-30 and 2026-07-03; public 2026-08-13). Advisories do not mention campaigns, honeypot hits, victim exploitation, or public exploit code. Credits: Bryan Mbeumo and elden (ZDI-26-571); GangMin Kim (ZDI-26-574); elden and Brayn Mbeumo (ZDI-26-568); Pitticus (ZDI-26-569); Xavier DANEST (ZDI-26-577).

Risk

Successful Linux bugs yield kernel-equivalent integrity/confidentiality/availability impact with changed scope (S:C) on the local host—full kernel code execution, not just the calling process (ZDI). Three of the four kernel issues already require high privilege, so they mainly matter as sandbox/container/capability-boundary escapes rather than unprivileged-to-root from a default user. ZDI-26-571 is the broader host risk because it starts from low privilege. Trend Micro VPN (ZDI-26-577) is a user-to-SYSTEM escalation on Windows-style installations of that product only; it does not affect the kernel net-scheduler surface. Blast radius is per-machine; no wormable or multi-host failure mode is described.

Remediation

  • Apply the Linux updates ZDI points to: a8a02897f2b479127db261de05cbf0c28b98d159 (ZDI-26-571), f462dca0c8415bf0058d0ffa476354c4476d0f09 (ZDI-26-574), f1f5c8a3955f8fda3f84ed883ac8daa1847e724c (ZDI-26-568), e5b811fe793166aecc59b085c1b7c31262ef2316 (ZDI-26-569). Confirm the equivalent stable/distro packages contain those commits; reboot into the patched kernel.
  • Trend Micro VPN: apply the vendor fix documented at hxxps://helpcenter[.]trendlife[.]com/en-us/article/TMKA-13331/ (ZDI-26-577).
  • Hunting: ZDI gives no IOCs. Defenders can inventory hosts running unpatched kernels with traffic-control / classifier features enabled and hosts with Trend Micro VPN; there is no stated detection signature for exploitation.
  • Validation: after patching, confirm kernel/package versions include the listed commits and that the VPN build matches TMKA-13331. No exploit test procedure is provided in the sources.

CVE / identifiers

CVE-2026-64530 (ZDI-26-571, ZDI-CAN-31222); CVE-2026-46319 (ZDI-26-574, ZDI-CAN-29413); CVE-2026-67212 (ZDI-26-577, ZDI-CAN-29830). ZDI-26-568 (ZDI-CAN-31523) and ZDI-26-569 (ZDI-CAN-30840) have no CVE listed in the advisories.

Confidence

medium — multiple ZDI advisories agree on local LPE, named functions/objects, and patch commits, but they omit trigger path, affected version ranges, and any exploitation evidence; two kernel items lack CVEs; the Trend Micro VPN item is a different product bundled only by disclosure date.

Open questions

Affected upstream/distro kernel versions and required capabilities (e.g. whether unprivileged tc/netlink can hit these objects) are not stated. Whether the three PR:H races are practically useful without existing high privilege is unexplained. No public write-ups of the UAF vs. race primitives. Why ZDI-26-568/569 have no CVE. Whether Trend Micro VPN belongs in the same operational cluster beyond same-day ZDI publication. Exploitation status remains unknown.

Sources