ZDI Accidentally Posts Unpatched Linux Kernel Flaws, CVSS up to 9.0, to Public Mailing List
jedisct1 · x · 2026-10-23
Trend Micro's Zero Day Initiative mistakenly sent several unpatched Linux kernel vulnerability reports to the public Linux kernel mailing list (LKML) instead of the private security list.
- ZDI-CAN-33549: SMB Direct remote code execution via integer underflow, CVSS 9.0; patch was queued for Linux v7.5 but will presumably be expedited to mainline.
- ZDI-CAN-33774: KSMBD race condition leading to remote code execution, also CVSS 9.0.
- ZDI-CAN-33367: skbuff skbzerocopy flaw enabling local privilege escalation; developers had received a report on the same issue from another source last week, with a patch expected.
None are fixed on mainline yet. Linux second-in-command Greg Kroah-Hartman replied to each report asking why they were submitted to the public list.
More from Safety
- AI-found PHP flaws put up to 70% of websites at risk, triggering a global patch race — LouMM · 2026-10-23
- Researcher pushes back on 'worst day in cybersecurity history' claims about php2shell — joshua_saxe · 2026-10-23
- Security must shift left: patched exploits now spread at near-zero cost worldwide — fforres · 2026-10-23
- Major US banks lock out AI agents that log in with customer credentials — The Decoder · 2026-10-23
- Anthropic's anti-distillation defense cuts attacks 90-99%, but expert data is still for sale — johnkorrigan · 2026-10-23
- Stanford HAI fellow testifies to California Senate on AI agents' privacy and accountability risks — StanfordHAI · 2026-10-23