Linux Kernel Vulnerabilities Hit the Public Mailing List Before the Fixes, Two of Them Rated ...

Six unpatched Linux kernel vulnerability reports from Trend Micro’s Zero Day Initiative landed on the public kernel mailing list instead of the private security list, and two of them are remote code execution bugs in the in-kernel SMB server rated CVSS 9.0.

Six unpatched Linux kernel vulnerability reports from Trend Micro’s Zero Day Initiative landed on the public kernel mailing list instead of the private security list, and two of them are remote code execution bugs in the in-kernel SMB server rated CVSS 9.0.

Linux kernel vulnerabilities normally reach the world in a fixed order: a private report to the kernel security team, a quiet fix, a stable release, and only then the public write-up. This week that order broke. Over the past two days, Trend Micro’s Zero Day Initiative (ZDI) sent a batch of vulnerability reports to the public Linux kernel mailing list (LKML) rather than to the closed security address, so the details went out before mainline had fixes for them. Phoronix spotted the posts first, and The Hacker News has since confirmed the two critical KSMBD flaws.

It looks like a mistake rather than a protest. Greg Kroah-Hartman, the stable kernel maintainer, replied to each report asking why it had been sent to the public list. That question does not unsend anything, though. Anyone reading LKML now knows where to look.

The two reports that matter most both target KSMBD, the SMB3 file server that lives inside the kernel itself:

ZDI-CAN-33549 (CVSS 9.0): an integer underflow in the SMB Direct path that can lead to remote code execution. A fix already sits in a branch meant for Linux 7.5, and will now presumably be fast-tracked.

ZDI-CAN-33774 (CVSS 9.0): a race condition in KSMBD, again leading to remote code execution.

ZDI-CAN-33367 : a flaw in the networking stack’s skb_zerocopy handling that allows local privilege escalation. Kernel developers had a separate report on the same bug last week, and a patch is expected shortly.

ZDI-CAN-34068 : an out-of-bounds write in vmwgfx, the VMware virtual GPU driver, also a local privilege escalation.

ZDI-CAN-34076 : an uninitialized resource in the NVMe target code that can leak information.

A sixth report, ZDI-CAN-32005, hit the list a day earlier: a stack buffer overflow tied to -domain handling in a TCP query path, once more leading to local privilege escalation.

Who should actually worry

The CVSS 9.0 numbers look alarming, but the exposure is narrower than the score suggests. KSMBD is not Samba. Most desktop distributions do not load it, and a gaming PC or workstation that never shares files over SMB from the kernel is not running it. The machines at risk are NAS boxes, servers and appliances that picked KSMBD for its speed, and any of those with port 445 reachable from an untrusted network should be treated as exposed until a fixed kernel ships. Unloading the module or firewalling SMB is the obvious stopgap.

The vmwgfx bug only matters inside VMware guests, and the NVMe target flaw only on systems exporting storage over NVMe-oF. The local privilege escalations need an attacker who already has a foothold, which is a smaller problem on a single-user PC and a bigger one on shared servers.

A busy pipeline gets busier

The timing is awkward. Kernel maintainers are already complaining the sheer volume of bug reports, much of it now generated or assisted by AI tooling, and Linux 7.4 is in its merge window. An accidental public disclosure forces a handful of these fixes to jump the queue, and it leaves distribution maintainers backporting patches on someone else’s schedule.

For users, the advice is dull but correct: watch for your distribution’s kernel update over the coming days, and if you run KSMBD anywhere, check whether you actually need it.