Skip to content
Linux Kernel Vulnerabilities Disclosed on Public Mailing List

Linux Kernel Vulnerabilities Disclosed on Public Mailing List

First seen 22 Oct 2026, 19:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 21:13 UTC
  • •Two critical CVSS 9.0 vulnerabilities in Linux's KSMBD SMB server disclosed publicly.
  • •Vulnerabilities allow remote code execution without authentication; no mainline fixes available.
  • •Patches for some vulnerabilities are in testing, but urgent action is needed from system administrators.

On October 22, 2026, several high-severity Linux kernel vulnerabilities were accidentally disclosed on the public Linux kernel mailing list instead of the private security list. Among these, two vulnerabilities in the KSMBD SMB server have CVSS scores of 9.0 and can be exploited for remote code execution without authentication. There are currently no patches available in the mainline kernel for these vulnerabilities, although some patches are undergoing testing. The vulnerabilities include an integer underflow leading to remote code execution and a race condition also resulting in remote code execution. The Linux kernel development team is aware of these issues, and security reports have been received from multiple sources. The incident highlights the ongoing challenges in managing vulnerability disclosures in the open-source community.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-22
Vulnerabilities disclosed on public mailing list
Several Linux kernel vulnerabilities, including two critical RCE flaws, were accidentally posted on the public mailing list.
Phoronix
2026-10-22
Alert issued by The Hacker News
The Hacker News reported on the critical vulnerabilities, emphasizing the lack of authentication required for exploitation.
X

More articles in this cluster (4)

Common questions

What are the CVSS scores of the vulnerabilities?
Both critical vulnerabilities in the KSMBD SMB server have CVSS scores of 9.0.
Are there any patches available?
No, there are currently no mainline kernel fixes available for these vulnerabilities.
What should system administrators do?
Administrators should consider unloading the KSMBD module if not in use and restrict access to affected services.