Trend Micro Emailed Unpatched Linux Kernel Flaws to a Public Mailing List, and the Kernel's No. 2 Pushed Back

The details of several unpatched Linux kernel vulnerabilities are now sitting in public, and the people who put them there are the ones whose job is keeping such things quiet. Trend Micro's Zero Day Initiative, the bug bounty program built around coordinated disclosure, emailed its reports to the public Linux kernel mailing list instead of only the private security team. Two of the flaws are rated CVSS 9.0 for remote code execution.

None of them had been fixed in mainline when the emails went out. That leaves defenders waiting on patches while anyone reading the list already knows where to look.

What went out

The "New Vulnerability Report" emails were sent from ZDI's disclosure address around 21:25 to 21:27 UTC on October 21, addressed to public lists including LKML with the private [email protected] list only on copy. Phoronix first reported it the next day, describing the routing as seemingly a mistake. ZDI had not publicly explained what happened as of October 23, and no CVEs have been assigned yet.

The two most serious reports hit KSMBD, the optional SMB file server built into the Linux kernel. ZDI-CAN-33549 is a remote code execution bug in KSMBD's SMB Direct path, caused by an integer underflow; a fix sits in a branch meant for Linux 7.5 and will presumably be fast tracked. ZDI-CAN-33774 is a KSMBD race condition that can also lead to remote code execution. Both carry a CVSS score of 9.0.

The rest of the batch is local. ZDI-CAN-33367 is a privilege escalation in the skb_zerocopy networking code, a bug kernel developers had already heard about from another source the week before, with a patch expected soon. ZDI-CAN-34068 is an out of bounds write in the vmwgfx VMware graphics driver, also leading to privilege escalation. ZDI-CAN-34076 is an uninitialized resource in the nvmet NVMe over Fabrics target code that can leak information.

A related report posted a day earlier, ZDI-CAN-32005, is not a kernel bug at all. It describes a stack buffer overflow in ConnMan, a network management service, in the way it handles search domain TCP queries, again leading to local privilege escalation.

"Please fix your submission process"

Greg Kroah-Hartman, the stable kernel maintainer often described as Linux's second in command, answered each report early on October 22. His replies were short and increasingly exasperated.

On the vmwgfx report, he wrote that ZDI had sent it to public lists without a patch, "so there's not much we can do with this." On the nvmet one: "Again, no patch, and sent to a public list? Please fix your submission process..." Other developers on the list piled on with their own complaints.

The frustration is easy to understand. Coordinated disclosure exists so that maintainers get time to write and ship a fix before attackers get the details. Here the details arrived first, and in some cases the fixes are still in testing or sitting in -next branches.

Who is exposed

KSMBD is separate from Samba, so systems running only Samba are not automatically affected by the two critical bugs. Exposure depends on whether KSMBD is enabled at all, and the SMB Direct path relies on RDMA networking. KSMBD is optional, and admins can check whether their machines load it.

Even where fixes exist in development branches, they still have to land in stable releases and then in distribution kernels before most users can install them. Linux 7.3 stable shipped only days ago, and 7.4 is in development.

The timing makes the slip worse. Reports credit Trend Micro's AI scanner with finding the bugs, and kernel guidance now treats AI found bugs as effectively public anyway, on the assumption that someone else's tooling will find them too. AI is also shortening the time it takes attackers to turn bug details into working exploits. It was a rough week for disclosure in general: a set of critical PHP flaws leaked before the patch as well.

"The bug and security reports keep on coming in the AI fueled world," Phoronix wrote. This time, they came with the patches missing.

Some offers on this page may be paid placements or contain affiliate links.