Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List - CyberSecurityNews

Several unpatched Linux-related security flaws were posted to public mailing lists in October, exposing technical details before fixes were ready. The reports, submitted by Trend Micro's Zero Day Initiative (ZDI), include two critical flaws rated CVSS 9.0 that could let a remote attacker run code on systems using the Linux kernel's KSMBD file server. Other reports describe local privilege-escalation and information-disclosure risks.

The reports appeared on public lists, and Linux kernel maintainer Greg Kroah-Hartman questioned why some submissions were sent there without patches. But the reports credit Trend Micro's AI scanner, and reporting on the disclosure points to updated kernel guidance that treats AI-found bugs as already public. ZDI had not publicly explained the routing as of October 23, 2026, so it remains unclear whether this was a simple mistake.

Critical Flaws in KSMBD

The most urgent reports concern KSMBD, an optional SMB file server built into the Linux kernel. It is separate from Samba, the commonly used file-sharing software. That means the reports do not automatically affect Linux systems running Samba alone. The immediate question for operators is whether KSMBD is enabled and serving files.

ZDI-CAN-33774 describes a race condition in KSMBD that could lead to remote code execution. A race condition occurs when the outcome depends on the timing of tasks running at the same time. In this case, the report says that a mismatch in how the server handles queued network requests may lead to memory being read or written beyond its intended limits. ZDI rated the flaw CVSS 9.0.

ZDI-CAN-33549, also rated CVSS 9.0, affects KSMBD's SMB Direct path. The reported cause is an integer underflow: a size value can wrap around after a subtraction, leaving the program with an incorrect length. A later memory operation may then exceed its buffer. The issue concerns SMB Direct, which uses RDMA networking, so exposure depends on the server's configuration and use of that feature.

A fix was reportedly present in a development branch intended for Linux 7.5, but that does not mean it was already available in released or distribution kernels. At the time of reporting, neither critical issue had a named fix in the mainline kernel or its integration tree, and no CVE identifier had been assigned. Kernel changes also need to reach stable and distribution releases before many users can install them.

Other Vulnerabilities Reported

The remaining reports do not all affect the same part of Linux. ZDI-CAN-33367 involves the skb_zerocopy networking code and may allow a local user to gain higher privileges. Kernel developers had reportedly received a separate report about the same issue the previous week, with a patch expected. ZDI-CAN-34068 concerns an out-of-bounds write in the VMware graphics driver, which could also enable local privilege escalation.

ZDI-CAN-34076 involves an uninitialized resource in the NVMe over Fabrics target code and may expose information. ZDI-CAN-32005, posted a day earlier, is a stack-buffer overflow in ConnMan's handling of search-domain TCP queries. ConnMan is a network-management service, not a Linux kernel component, so this report should not be described as a kernel flaw.

Recommended Actions

Start by checking whether KSMBD is active and whether the system needs it. If it is not required, disabling it reduces exposure to the two remote-code-execution reports. If it is needed, keep file-sharing services away from untrusted networks, review share access, and monitor the Linux distribution's security updates for fixes. These steps reduce risk but do not replace installing a vendor-approved patch once it becomes available.

The reports also show why public disclosure before a fix can create pressure for maintainers and system operators. Public details can help defenders understand what to check, but they can also give attackers useful information before updates reach users. For ongoing protection, administrators should follow their distribution's advisories and apply fixes as soon as they are released.