Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)
Linux kernel: ksmbd (in-kernel SMB server) and SMB Direct, skbuff/NFQUEUE networking, vmwgfx, nvmet
On Oct 21, Trend Micro's Zero Day Initiative sent several unpatched Linux kernel vulnerability reports to security@kernel.org but Cc'd the public linux-kernel and subsystem lists, so full technical details (code paths, KASAN traces) are now public before fixes ship. The worst are two ksmbd (in-kernel SMB server) remote code execution bugs that ZDI scores CVSS 9.0: an SMB Direct integer underflow (needs an RDMA device and a writable share) and a protocol-dispatch race (needs a guest share). Also leaked: an skb_zerocopy local privilege escalation (CVSS 7.8), a vmwgfx out-of-bounds write LPE, and an nvmet info leak. No CVEs yet and no fixed mainline or stable release; the ksmbd race fix sits in the ksmbd maintainer tree and an SMB Direct fix is in a branch aimed at Linux 7.5. No exploitation reported. Only machines running ksmbd are exposed to the RCEs.
Why this severity: ZDI-scored CVSS 9.0 for the two ksmbd RCEs (AV:N/AC:H/PR:N); 7.8 for skb_zerocopy LPE; no CVEs yet; no known exploitation
- Started
- Oct 21, 2026
Affected
- Reports were tested on Linux 7.3-rc1 and 7.3-rc3 (Debian trixie); exact first affected versions not published
- ksmbd RCEs only matter if the in-kernel SMB server (ksmbd) is loaded and serving shares; SMB Direct bug needs an RDMA device and CONFIG_SMB_SERVER_SMBDIRECT
Fixed in
- No fixed mainline or stable kernel yet
- ksmbd race (ZDI-CAN-33774): fix commit 68f410faedaf in the ksmbd maintainer tree (linkinjeon/smb.git), not yet in a release
- SMB Direct underflow (ZDI-CAN-33549): likely fixed in Stefan Metzmacher's for-7.5/smbdirect branch (unconfirmed)
Timeline6
Greg Kroah-Hartman replies to the reports: "For some reason you sent this to public lists, and did not include a patch" and "Please fix your submission process..."
SourceEric Dumazet says a patch for the skb_zerocopy bug, reported by someone else a week earlier, will be available soon.
SourcePhoronix reports the leak. ksmbd maintainer Namjae Jeon says the ksmbd race is already fixed in his tree.
SourceZDI sends ZDI-CAN-33549, 33774, 33367, 34068 and 34076 to security@kernel.org with public lists (linux-kernel, linux-cifs, netdev, dri-devel) in Cc.
SourceStefan Metzmacher asks the reporter to test his for-7.5/smbdirect branch, saying the SMB Direct bug is probably already fixed there.
SourceNamjae Jeon commits a ksmbd fix for the negotiation race ("ksmbd: wait for negotiation before receiving another PDU") after a separate report.
Source
Advisories5
- ZDI-CAN-33549: KSMBD SMB Direct integer underflow RCE (CVSS 9.0)LKML / ZDI · Oct 21, 2026
- ZDI-CAN-33774: KSMBD protocol dispatch race RCE (CVSS 9.0)LKML / ZDI · Oct 21, 2026
- ZDI-CAN-33367: skbuff skb_zerocopy local privilege escalation (CVSS 7.8)LKML / ZDI · Oct 21, 2026
- ZDI-CAN-34068: vmwgfx dirty tracking out-of-bounds write LPE (Greg KH reply)dri-devel · Oct 22, 2026
- ZDI-CAN-34076: nvmet Get Log Page uninitialized resource info disclosure (Greg KH reply)lore.kernel.org · Oct 22, 2026
News & write-ups2
Posts3
Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List As high as CVSS 9.0. Whoops. t.co/opCRSE80Vq
Trend Micro's ZDI posted unpatched Linux kernel bugs to the public mailing list by mistake. - ksmbd race: RCE, CVSS 9.0 - SMB Direct underflow: RCE, CVSS 9.0 - skb_zerocopy: local privilege escalation No mainline fix yet. Anyone actually running ksmbd in production? t.co/OAxNNSvdtG
Linuxカーネルの未修正脆弱性が、再現コードつきで公開メーリングリストに流れた。 t.co/VzG4TT7bJz 送ったのはTrend Micro傘下のZDI。 宛先にはsecurity@kernel.orgが指定されていたが、Ccに公開リスト（linux-kernel等）が含まれていた。 CVSS 9.0が2件。 いずれもカーネル内蔵SMBサーバーksmbdの問題で、RDMAデバイスとSMB Directを使う構成が影響を受ける。 Linuxカーネルのナンバー2、Greg Kroah-Hartman氏はパッチなしで公開リストに送られたことを問題視し、報告プロセスの修正を求めている。 ZDIの正式なアドバイザリ公開は2027年2月予定。 技術詳細はすでに読める。
Notes & caveats
Facts from the LKML threads themselves (To: security@kernel.org, Cc: public lists) and Phoronix. CVSS scores are ZDI's own, not NVD's; no CVE IDs assigned yet. Phoronix also lists ZDI-CAN-32005, but that is a ConnMan (userspace DNS proxy) bug sent to the ConnMan list on Oct 20, not a kernel bug, so it is left out. Separate from PwnEscape (CVE-2026-99999). The SMB Direct fix in for-7.5/smbdirect is the maintainer's guess, not confirmed.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
