ZDI-26-443: Linux Kernel vmwgfx LPE — Mitigation and Detection Strategies

---
title: Suspicious VMware Graphics Driver Interaction
id: 8a7b9c1d-2e3f-4a5b-6c7d-8e9f0a1b2c3d
status: experimental
description: Detects attempts to interact with the vmwgfx device node, which is the attack surface for ZDI-26-443. Frequent or unusual access patterns from non-graphical applications may indicate exploit probing.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-443/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: linux
  service: auditd
detection:
  selection_device:
    type: PATH
    path|contains: '/dev/dri/renderD128' # Common device path for vmwgfx, adjust based on env
  selection_syscall:
    type: SYSCALL
    syscall: ioctl
  condition: selection_device and selection_syscall
falsepositives:
  - Legitimate graphical applications (browsers, window managers)
level: low
---
title: Unauthorized Privilege Escalation to Root
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects a process immediately gaining root UID (0) from a non-root session, a post-exploitation signal of LPE success.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-443/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    euid: '0'
    uid|gt: '0'
  filter_legit:
    comm:
      - 'sudo'
      - 'su'
      - 'polkit-agent'
  condition: selection and not filter_legit
falsepositives:
  - Administrators using sudo/su (though usually logged as uid 0 already)
level: high

// Hunt for processes spawning with root privileges from a non-root parent
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessAccountName != "root" and AccountName == "root"
| where InitiatingProcessFileName !in ("sudo", "su", "doas", "pkexec")
| project Timestamp, DeviceName, AccountName, InitiatingProcessAccountName, ProcessCommandLine, InitiatingProcessCommandLine, FileName
| order by Timestamp desc

-- Hunt for processes where Effective UID is 0 (root) but Real UID is not
SELECT Pid, Name, Username, Uid, EffectiveUid, CommandLine, Exe
FROM pslist()
WHERE EffectiveUid == 0
  AND Uid != 0
  AND Name NOT IN ('sudo', 'su', 'bash', 'sh')
LIMIT 50

#!/bin/bash
# Remediation script for ZDI-26-443 (vmwgfx LPE)
# Checks for module load status and blacklists if not strictly required.

MODULE_NAME="vmwgfx"

echo "[+] Checking if $MODULE_NAME module is loaded..."
if lsmod | grep -q "^${MODULE_NAME} "; then
    echo "[!] WARNING: $MODULE_NAME module is currently loaded."
    echo "[*] It is recommended to update the Kernel to the latest version provided by your vendor."
    echo "[*] If 3D acceleration is not required, consider blacklisting the module."
    
    # Check if blacklist exists
    if ! grep -q "^blacklist $MODULE_NAME" /etc/modprobe.d/*.conf 2>/dev/null; then
        echo "[*] Creating blacklist entry in /etc/modprobe.d/blacklist-$MODULE_NAME.conf"
        echo "blacklist $MODULE_NAME" > /etc/modprobe.d/blacklist-$MODULE_NAME.conf
        echo "[*] Running update-initramfs to apply changes..."
        update-initramfs -u
        echo "[!] Reboot required to unload the module."
    else
        echo "[+] Module already blacklisted. Please reboot to unload if currently in use."
    fi
else
    echo "[+] Module $MODULE_NAME is not loaded. System is not vulnerable via this vector."
fi

echo "[+] Checking Kernel Version..."
uname -r
echo "[*] Please verify this version against your vendor's security advisory for ZDI-26-443."