ZDI Posts Unpatched Linux Kernel Flaw Details and Attack Chains on Public Mailing List
Do Son 
TL;DR
Trend Micro’s Zero Day Initiative (ZDI) posted details of several unpatched Linux kernel vulnerabilities to the public kernel mailing list on October 22, 2026. Two KSMBD flaws carry a CVSS score of 9.0 and can lead to remote code execution. Fixes are still moving through kernel development branches.
Why It Matters
Security bugs normally go to the private kernel security team first. This time, the full write-ups landed on the public Linux Kernel Mailing List (LKML). Phoronix, which reported the public ZDI disclosures on LKML, said it “seemingly was a mistake.”
The reports appeared as separate threads, such as this ZDI-CAN report on LKML, a second ZDI disclosure and a third LKML posting. Greg Kroah-Hartman questioned the public submissions in replies, including his response on the dri-devel list and another reply to ZDI.
Details now public
The posts describe root causes and attack conditions in detail. One report even walks through a demonstrated attack chain for a networking bug. As a result, attackers now have a head start on these Linux kernel vulnerabilities before patches reach users.
How the Attacks Work
KSMBD remote code execution
- ZDI-CAN-33774 (CVSS 9.0): a race condition in how KSMBD assigns its handler table. It “requires no authentication, exposing any server running KSMBD on port 445.”
- ZDI-CAN-33549 (CVSS 9.0): an integer underflow in SMB Direct. Crafted RDMA buffer descriptors make a size counter wrap, so a memory copy overruns its buffer. It needs RDMA support, a writable KSMBD share and SMB Direct.
Local privilege escalation and leaks
- ZDI-CAN-33367: skb_zerocopy() drops a shared-fragment marker. ESP decryption can then write into page-cache data, letting an unprivileged process alter a file it “can read but cannot open for writing.”
- ZDI-CAN-34068: an out-of-bounds write in the VMware VMWGFX graphics driver.
- ZDI-CAN-34076: an uninitialized resource in NVMET that leaks information.
Separately, ZDI posted a ConnMan DNS proxy report a day earlier. That bug, ZDI-CAN-32005, is a stack buffer overflow.
Exploitation status
No source reports attacks in the wild. None of these flaws has a CVE ID yet.
Affected Versions
The reports do not list exact kernel versions. Mainline kernels remain unpatched for now.
Patch and Mitigation Steps
- Disable KSMBD if you do not need it, or block port 445 from untrusted networks.
- Turn off SMB Direct where RDMA is not required.
- Watch your distribution for kernel updates.
An SMB Direct fix sits in a branch aimed at Linux 7.5 and may be expedited. Developers also expect a skb_zerocopy patch soon. Until then, limit exposure to these Linux kernel vulnerabilities.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
