Zero Day Initiative accidentally discloses unpatched Linux kernel flaws on public mailing list

What happened

A batch of vulnerability reports describing unpatched Linux kernel bugs showed up on the public Linux kernel mailing list (LKML) overnight, rather than on the private security mailing list where such reports are normally routed. According to Phoronix, the reports came from Trend Micro's Zero Day Initiative (ZDI), and the public posting appears to have been a mistake rather than a deliberate disclosure decision.

Greg Kroah-Hartman, whom Phoronix describes as second-in-command in the kernel project, replied to each individual report asking why it had been submitted to the public list. None of the flaws are fixed in mainline yet, although Phoronix reports that patches for some of them are already undergoing testing or sitting queued in the "-next" integration branches.

The vulnerabilities

Phoronix lists six issues, with CVSS severity scores reaching 9.0:

• ZDI-CAN-33549 — Scored CVSS 9.0, this is a remote code execution flaw in SMB Direct caused by an integer underflow. A fix already exists in a Git branch earmarked for the Linux v7.5 development cycle, which Phoronix expects will now be expedited into mainline.
• ZDI-CAN-33774 — Also rated CVSS 9.0, a race condition in KSMBD, the kernel's SMB server implementation, that can be exploited for remote code execution.
• ZDI-CAN-33367 — A bug in the skbuff skb_zerocopy handling in the networking code that allows local privilege escalation. Kernel developers reportedly received a separate report about the same issue from another source the previous week, and a patch is expected to be posted soon.
• ZDI-CAN-34068 — An out-of-bounds write in the VMWGFX VMware graphics driver that can be used for local privilege escalation.
• ZDI-CAN-34076 — An uninitialized resource in the NVMET (NVMe target) code that leads to information disclosure.
• ZDI-CAN-32005 — A stack buffer overflow reachable through a search-domain TCP query, resulting in local privilege escalation. Phoronix notes this one landed on the list a day before the rest.

A compressed timeline

The kernel project's usual flow is designed to avoid exactly this situation: researchers report to a private list, maintainers coordinate and merge fixes, and details become public only once patched releases are available. An accidental publication collapses that timeline. Anyone watching LKML now has technical descriptions of the bugs while mainline remains unfixed, which puts pressure on maintainers to fast-track the pending patches — the SMB Direct fix queued for v7.5 being the clearest candidate.

Why it matters

Anyone running a mainline kernel with the affected subsystems enabled is now in the awkward position of facing flaws whose details are public but whose protections are not. The two CVSS 9.0 bugs in the SMB code paths are the most urgent, since they can be triggered remotely rather than requiring local access, which is a particular concern for machines exposing KSMBD or SMB Direct services. The VMWGFX and skbuff issues matter for multi-user hosts and virtualization setups where local privilege escalation is the goal.

Administrators who cannot wait for mainline fixes should at minimum check whether the affected components — KSMBD, VMWGFX and the NVMe target code — are enabled or loaded on their systems, and disable them where they are not needed, since unused subsystems are the easiest attack surface to remove.

The incident is also a reminder of how fragile coordinated disclosure is in practice. A single misdirected email from an established vulnerability broker was enough to put live bug details in front of the entire internet before a single fix had merged. Phoronix closes with the observation that the stream of kernel bug and security reports shows no sign of slowing down.