{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T16:23:59.585Z", "tag": { "id": "ksmbd", "label": "ksmbd", "isStack": false, "url": "https://pwn.watch/t/ksmbd", "feed": "https://pwn.watch/t/ksmbd/feed.xml" }, "counts": { "incidents": 1, "live": 1, "notFullyPatched": 1, "patched": 0 }, "incidents": [ { "slug": "linux-kernel-zdi-reports-leaked-to-lkml", "title": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)", "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml", "json": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml.json", "status": "live", "severity": "critical", "patchStatus": "unpatched", "product": "Linux kernel: ksmbd (in-kernel SMB server) and SMB Direct, skbuff/NFQUEUE networking, vmwgfx, nvmet", "tags": [ "linux", "ksmbd", "zdi", "rce" ], "cveIds": [], "affectedVersions": [ "Reports were tested on Linux 7.3-rc1 and 7.3-rc3 (Debian trixie); exact first affected versions not published", "ksmbd RCEs only matter if the in-kernel SMB server (ksmbd) is loaded and serving shares; SMB Direct bug needs an RDMA device and CONFIG_SMB_SERVER_SMBDIRECT" ], "fixedVersions": [ "No fixed mainline or stable kernel yet", "ksmbd race (ZDI-CAN-33774): fix commit 68f410faedaf in the ksmbd maintainer tree (linkinjeon/smb.git), not yet in a release", "SMB Direct underflow (ZDI-CAN-33549): likely fixed in Stefan Metzmacher's for-7.5/smbdirect branch (unconfirmed)" ], "startedAt": "2026-10-21", "closedAt": null, "updatedAt": "2026-10-22T18:15:27+02:00", "summary": "On Oct 21, Trend Micro's Zero Day Initiative sent several unpatched Linux kernel vulnerability reports to security@kernel.org but Cc'd the public linux-kernel and subsystem lists, so full technical details (code paths, KASAN traces) are now public before fixes ship. The worst are two ksmbd (in-kernel SMB server) remote code execution bugs that ZDI scores CVSS 9.0: an SMB Direct integer underflow (needs an RDMA device and a writable share) and a protocol-dispatch race (needs a guest share). Also leaked: an skb_zerocopy local privilege escalation (CVSS 7.8), a vmwgfx out-of-bounds write LPE, and an nvmet info leak. No CVEs yet and no fixed mainline or stable release; the ksmbd race fix sits in the ksmbd maintainer tree and an SMB Direct fix is in a branch aimed at Linux 7.5. No exploitation reported. Only machines running ksmbd are exposed to the RCEs.", "xPost": null } ], "posts": [ { "authorName": "情報の灯台", "handle": "joho_no_todai", "avatarUrl": "https://pbs.twimg.com/profile_images/2112591874821398528/vSKACoJ9_bigger.jpg", "text": "Linuxカーネルの未修正脆弱性が、再現コードつきで公開メーリングリストに流れた。\nhttps://t.co/VzG4TT7bJz\n\n送ったのはTrend Micro傘下のZDI。\n\n宛先にはsecurity@kernel.orgが指定されていたが、Ccに公開リスト（linux-kernel等）が含まれていた。\n\nCVSS 9.0が2件。\n\nいずれもカーネル内蔵SMBサーバーksmbdの問題で、RDMAデバイスとSMB Directを使う構成が影響を受ける。\n\nLinuxカーネルのナンバー2、Greg Kroah-Hartman氏はパッチなしで公開リストに送られたことを問題視し、報告プロセスの修正を求めている。\n\nZDIの正式なアドバイザリ公開は2027年2月予定。\n技術詳細はすでに読める。", "date": "2026-10-22T12:31:20.000Z", "url": "https://x.com/joho_no_todai/status/2113246828997329182", "media": [], "incident": "linux-kernel-zdi-reports-leaked-to-lkml" }, { "authorName": "dip497", "handle": "Griflet497", "avatarUrl": "https://pbs.twimg.com/profile_images/2038899595338756096/VMloeCi4_bigger.jpg", "text": "Trend Micro's ZDI posted unpatched Linux kernel bugs to the public mailing list by mistake.\n\n- ksmbd race: RCE, CVSS 9.0\n- SMB Direct underflow: RCE, CVSS 9.0\n- skb_zerocopy: local privilege escalation\n\nNo mainline fix yet. Anyone actually running ksmbd in production? https://t.co/OAxNNSvdtG", "date": "2026-10-22T12:11:03.000Z", "url": "https://x.com/Griflet497/status/2113241724026040718", "media": [], "incident": "linux-kernel-zdi-reports-leaked-to-lkml" }, { "authorName": "Phoronix", "handle": "phoronix", "avatarUrl": "https://pbs.twimg.com/profile_images/937312281662279682/bqi_9AN2_bigger.jpg", "text": "Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List\n\nAs high as CVSS 9.0. Whoops.\n\nhttps://t.co/opCRSE80Vq", "date": "2026-10-22T10:07:35.000Z", "url": "https://x.com/phoronix/status/2113210651371819361", "media": [], "incident": "linux-kernel-zdi-reports-leaked-to-lkml" } ], "changes": [ { "incident": "linux-kernel-zdi-reports-leaked-to-lkml", "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-10-22", "title": "Greg Kroah-Hartman replies to the reports: \"For some reason you sent this to public lists, and did not include a patch\" and \"Please fix your submission process...\"", "body": null, "sourceUrl": "https://lore.kernel.org/dri-devel/2026102254-protector-seventy-6454@gregkh/", "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml" }, { "incident": "linux-kernel-zdi-reports-leaked-to-lkml", "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-10-22", "title": "Eric Dumazet says a patch for the skb_zerocopy bug, reported by someone else a week earlier, will be available soon.", "body": null, "sourceUrl": "https://lore.kernel.org/lkml/BYAPR01MB3830CECF5D0871064C59BA0280662@BYAPR01MB3830.prod.exchangelabs.com/", "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml" }, { "incident": "linux-kernel-zdi-reports-leaked-to-lkml", "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-10-22", "title": "Phoronix reports the leak. ksmbd maintainer Namjae Jeon says the ksmbd race is already fixed in his tree.", "body": null, "sourceUrl": "https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities", "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml" }, { "incident": "linux-kernel-zdi-reports-leaked-to-lkml", "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-10-21", "title": "ZDI sends ZDI-CAN-33549, 33774, 33367, 34068 and 34076 to security@kernel.org with public lists (linux-kernel, linux-cifs, netdev, dri-devel) in Cc.", "body": null, "sourceUrl": "https://lore.kernel.org/lkml/BYAPR01MB3830472B5702C089B0BBB77D80662@BYAPR01MB3830.prod.exchangelabs.com/", "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml" }, { "incident": "linux-kernel-zdi-reports-leaked-to-lkml", "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-10-21", "title": "Stefan Metzmacher asks the reporter to test his for-7.5/smbdirect branch, saying the SMB Direct bug is probably already fixed there.", "body": null, "sourceUrl": "https://lore.kernel.org/lkml/BYAPR01MB3830472B5702C089B0BBB77D80662@BYAPR01MB3830.prod.exchangelabs.com/", "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml" }, { "incident": "linux-kernel-zdi-reports-leaked-to-lkml", "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-09-30", "title": "Namjae Jeon commits a ksmbd fix for the negotiation race (\"ksmbd: wait for negotiation before receiving another PDU\") after a separate report.", "body": null, "sourceUrl": "https://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb.git/commit/?id=68f410faedaf6ee74d81e574733c50ebcc1bd8ed", "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml" } ] }