Trend Micro's ZDI posted unpatched Linux kernel bug reports to the public mailing list, two of them rated CVSS 9.0

Overnight before Thursday, October 22, a run of kernel vulnerability reports from Trend Micro’s Zero Day Initiative showed up on the Linux Kernel Mailing List, the most public inbox in open source. They were supposed to go to the private security list. “This seemingly was a mistake,” wrote Michael Larabel in Phoronix, who spotted the batch.

The list reads like a bad morning for anyone running a Linux file server. ZDI-CAN-33549 is an SMB Direct remote code execution bug from an integer underflow, rated CVSS 9.0. ZDI-CAN-33774 is a race condition in KSMBD, the kernel’s built-in SMB server, that can also lead to remote code execution, and it’s rated 9.0 too.

The rest are local: a privilege escalation in the networking code’s skb_zerocopy, an out-of-bounds write in the VMware graphics driver (VMWGFX) that leads to privilege escalation, and an uninitialized resource in the NVMe target code that leaks information. One more, a stack buffer overflow in the search-domain TCP query code, had gone to the public list a day earlier.

None of them is patched in mainline yet. Phoronix reports that some fixes are in testing or queued in “-next” branches, and the SMB Direct fix sits in a branch meant for Linux 7.5 that Larabel says “now presumably will be expedited for getting to mainline.” The skb_zerocopy bug had already reached kernel developers from another source the week before, with a patch expected soon.

Greg Kroah-Hartman, the kernel’s second-in-command, answered each report, asking ZDI about the public submission. What ZDI says back hasn’t been reported yet.

Why it matters

The private list has one job. The kernel’s own security bug process tells reporters to send a bug to the affected maintainers and Cc the security team, and “Do not send it to a public list at this stage.” security@kernel.org is “a private list of security officers” who help verify the report and get a fix built.

The embargo clock is short on purpose. Once a fix exists, the kernel team will hold it back for “up to 7 calendar days” at a reporter’s request, 14 in exceptional cases, and only for QA and rollout logistics. A report that goes out in public skips that window entirely: “Fixes for publicly known bugs are released immediately.”

This comes from the coordinated disclosure shop. ZDI’s disclosure policy normally gives a vendor “four months (120 days)” to ship a patch before ZDI publishes a limited advisory. These reports went public on day zero, from a company whose business model is the private part of that timeline.

The rules already lean public for some bugs. The same kernel document says a bug found with AI assistance “must” be treated as public, because those bugs “systematically surface simultaneously across multiple researchers, often on the same day,” and it allows public lists when a bug is trivial to rediscover with AI-based tools. Nothing in the reporting says ZDI found these with AI, which is why the public posting reads as a slip.

Larabel closed his piece with “The bug and security reports keep on coming in the AI fueled world.” The skb_zerocopy bug, reported by two parties a week apart, fits that pattern, and the kernel’s own process already assumes duplicate finds are the norm.

If that holds, the private embargo gets harder to defend for kernel bugs at all, and the time between “reported” and “fixed in mainline” matters more than who hears first. The next thing to watch is how fast the two CVSS 9.0 fixes for SMB Direct and KSMBD reach mainline and the stable trees, and whether ZDI explains how a To: line slipped.

Steal this

Before you send any security report, check the To: and Cc: lines against the project’s documented private address, for the kernel that’s security@kernel.org plus the subsystem maintainers. Kind of like reading the envelope before you lick it.
If any machine you run uses the kernel’s built-in SMB server (KSMBD) or SMB Direct, put it on your watch list today and apply the kernel update the day your distro ships the fix. This is like hearing the lock on your back door has a known flaw: you don’t wait for the burglar to confirm it.
When you report bugs to more than one project, write down each one’s disclosure clock before you hit send. The kernel holds a fix for at most 7 days (14 in exceptional cases); ZDI gives most vendors 120. A dentist and an emergency room both fix teeth, on very different schedules.

More Security