By ByteBot
This morning, Trend Micro’s Zero Day Initiative accidentally posted six Linux kernel vulnerability reports to the public Linux Kernel Mailing List instead of the private security channel — two of them scored CVSS 9.0 and enable remote code execution. None are patched in mainline Linux yet. Greg Kroah-Hartman, Linux’s second-in-command, responded to each mislaid report publicly: on one, he wrote, “For some reason you sent this to public lists, and did not include a patch, so there’s not much we can do with this.”
Two CVSS 9.0 Bugs — What They Actually Are
The two worst vulnerabilities are ZDI-CAN-33549 and ZDI-CAN-33774, both rated CVSS 9.0. ZDI-CAN-33549 is an integer underflow in SMB Direct — the RDMA-based, high-performance SMB implementation — that allows remote code execution without authentication. ZDI-CAN-33774 is a race condition in KSMBD, Linux’s in-kernel SMB server.
The KSMBD bug is subtle. The connection handler selects the SMB protocol version when it enqueues a PDU, but the worker thread reads that version only on dequeue. A concurrent request can flip the connection from SMB1 to SMB2 handling while an SMB1 buffer is still pending — the SMB2 code path then treats the short SMB1 allocation as a full SMB2 header, reads past the end of the buffer, and leaks heap bytes. Worse, under the right conditions it opens a remote code execution path. According to Phoronix’s coverage, patches for both are queued in “-next” branches but are not yet in mainline.
The other four vulnerabilities — affecting skb_zerocopy networking, the VMware VMWGFX driver, NVMET (NVMe over Fabrics), and TCP stack handling — are rated lower severity and enable local privilege escalation or information disclosure, not remote exploitation.
How the Accidental Disclosure Happened
Linux kernel security bugs are supposed to go to security@kernel.org — a private list managed by a small team of security officers. What actually happened: ZDI sent the reports to the linux-kernel mailing list, which is public, high-volume, and permanently archived. There is no taking it back. According to the kernel’s own security documentation, private submissions allow an embargo period where developers write and validate a fix before any attacker knows the details. Accidental public disclosure collapses that window to zero.
Greg KH’s frustration is visible in the public LKML archive. Without an accompanying patch, the kernel team cannot silently resolve a newly-public bug — they can only rush. That is the actual cost of this mistake: not just embarrassment, but the gap between “attackers know” and “users have a patch” is now open and uncontrolled.
Related: GitLab CVE-2026-110264: CVSS 10.0 RCE Hits Every Version Since 2014 — Patch Now
Who Is Actually at Risk — Check Your System Now
Most Linux deployments are not in the blast radius of the two CVSS 9.0 bugs. SMB Direct is used almost exclusively in high-performance storage environments with RDMA hardware — not typical Linux servers. KSMBD is the newer in-kernel SMB server; most deployments still run Samba in userspace. If you’re running Samba (smbd), ZDI-CAN-33774 does not apply to you. Run these commands to verify your exposure:
# Check if KSMBD kernel module is loaded
lsmod | grep ksmbd
# Check kernel config for SMB Direct (RDMA)
grep -i smb_direct /boot/config-$(uname -r) 2>/dev/null
# Check KSMBD service status
systemctl status ksmbd 2>/dev/null
If ksmbd shows as loaded and you have untrusted network access to the SMB port, isolate the service or restrict access until a patched kernel reaches your distribution’s stable channel. The ZDI-CAN-33549 patch was already in a branch for Linux v7.5 before this incident and is being fast-tracked to stable backports.
The Bigger Issue: AI-Assisted Research Is Flooding the Queue
This incident did not happen in isolation. The Phoronix report specifically notes that ZDI is managing what it calls an “AI-fueled world” of vulnerability submissions. Linus Torvalds previously called AI-generated bug reports a flood that made the private security list “almost entirely unmanageable.” Higher volume means more triage errors, and more triage errors mean more accidental public disclosures.
The kernel’s informal private-list model is showing cracks. It worked well when the number of security researchers was small and the process was low-volume. Neither of those is true anymore. Expect more incidents like this.
Key Takeaways
- Two CVSS 9.0 RCE bugs (SMB Direct and KSMBD) are now public knowledge before mainline patches exist — check your exposure immediately
- Most Linux servers running Samba are NOT affected by the CVSS 9.0 bugs; scope is specific to KSMBD and SMB Direct (RDMA) users
- Run
lsmod | grep ksmbdto verify exposure; if loaded and network-accessible, isolate the service until a patch ships - Patches are in “-next” branches and being fast-tracked; expect stable backports within days to weeks
- Rising AI-assisted vulnerability research volume is straining coordinated disclosure processes — this will not be the last accident
