Skip to content
audiotale.net
Sign in
NewsNews

Six unpatched Linux kernel flaws, two rated CVSS 9.0 in SMB code, posted to public LKML by ZDI

Trend Micro's Zero Day Initiative reports for SMB Direct, ksmbd, vmwgfx, nvmet and more reached the public mailing list without patches; here is how to limit exposure.

audiotale.net team

· 7 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. How it works
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

Several reports of unpatched Linux kernel vulnerabilities, written by Trend Micro's Zero Day Initiative (ZDI), appeared on the public Linux kernel mailing list overnight into 22 October 2026 instead of the private kernel security list. Two of them, in the kernel's SMB code, are rated CVSS 9.0 and described as remote code execution bugs. As of the reports we could read, none had a fix in mainline. Anyone running a Linux file server with the in-kernel SMB server, a hypervisor guest using the VMware graphics driver, or an NVMe-over-fabrics target should read the "What to do" section below.

Key points

  • ZDI reports for six Linux kernel flaws were posted to the public LKML overnight into 22 October 2026 (one a day earlier); Phoronix reported it, calling the posting accidental (we found no statement from ZDI or Trend Micro on that).
  • Two are rated CVSS 9.0: ZDI-CAN-33549 (SMB Direct, an integer underflow, remote code execution) and ZDI-CAN-33774 (a ksmbd race condition, remote code execution).
  • The other four are a local privilege escalation in skb_zerocopy (ZDI-CAN-33367, CVSS 7.8), an out-of-bounds write in the vmwgfx driver (ZDI-CAN-34068, CVSS 8.8), an information leak in nvmet (ZDI-CAN-34076, CVSS 8.6) and a stack buffer overflow in a search-domain TCP query (ZDI-CAN-32005).
  • Greg Kroah-Hartman replied that the reports had gone to public lists without patches, which leaves the kernel team little to act on; Phoronix says a patch for the SMB Direct bug sits in a Git branch for Linux v7.5 and may be expedited.
  • ZDI's own upcoming-advisories page lists five of the reports as reported on 21 October 2026 with a public-disclosure deadline of 18 February 2027, and none of these flaws has a CVE number in the sources we could read.

What to do

No fixed kernel exists yet in the sources we could open, so this is about reducing exposure while you wait for patches.

  • SMB (ZDI-CAN-33549, ZDI-CAN-33774): the reports concern SMB Direct and ksmbd, the in-kernel SMB server. Check whether it is loaded: lsmod | grep ksmbd and systemctl status ksmbd. If you do not serve files with ksmbd (Samba is a separate, user-space server and is not what the report names), unload it and blacklist the module. If you do rely on it, restrict TCP port 445 to trusted networks with a firewall and keep it off the internet. We have not confirmed which SMB Direct implementation the first report affects, so treat any kernel SMB server or SMB-over-RDMA setup as in scope until a fix says otherwise.
  • vmwgfx (ZDI-CAN-34068): this is the graphics driver for VMware virtual machines. It matters for Linux guests running on VMware products. It is a local privilege escalation, so an attacker needs to run code on the guest first.
  • nvmet (ZDI-CAN-34076): only relevant if the machine exports storage as an NVMe-over-fabrics target. The report describes an information leak, not code execution.
  • skb_zerocopy (ZDI-CAN-33367) and the TCP search-domain bug (ZDI-CAN-32005): both are local privilege escalations. On multi-user systems, shared hosts and container hosts, limit who can run code until fixes land.
  • Watch for kernel updates from your distribution (including the stable releases). Apply them when they mention these ZDI identifiers or the components named above, and reboot or live-patch as your distribution describes.

What happened

According to Phoronix, Trend Micro's Zero Day Initiative sent several vulnerability reports to the public Linux Kernel Mailing List rather than to the private security list the kernel project asks reporters to use. Greg Kroah-Hartman replied to the reports. The Openwall archive of linux-kernel holds his reply to ZDI-CAN-34068 (message 308, dated 22 October 2026): it says the report had been sent to public lists and had no patch, so the kernel team could not act on it yet. He copied the kernel security address, the DRM graphics maintainers and a Broadcom kernel review list.

The six reports, as Phoronix lists them:

ZDI ID Component Impact Notes
ZDI-CAN-33549 SMB Direct Remote code execution via integer underflow CVSS 9.0; patch in a Git branch for Linux v7.5
ZDI-CAN-33774 ksmbd Remote code execution via race condition CVSS 9.0
ZDI-CAN-33367 network skb_zerocopy Local privilege escalation CVSS 7.8; developers had a separate report of the same issue the week before; a patch is expected
ZDI-CAN-34068 vmwgfx Local privilege escalation via out-of-bounds write CVSS 8.8
ZDI-CAN-34076 nvmet Information disclosure via uninitialised resource CVSS 8.6
ZDI-CAN-32005 search-domain TCP query Local privilege escalation via stack buffer overflow Posted a day earlier than the others

Phoronix gives CVSS 9.0 for the two SMB bugs. The scores for the other entries come from ZDI's "upcoming advisories" page, which lists five of these (33549, 33774, 33367, 34068, 34076) as reported on 21 October 2026, each with a disclosure deadline of 18 February 2027. That page did not list ZDI-CAN-32005 in the part we could read, and it shows scores that match Phoronix for the two SMB bugs. CVSS scores on ZDI's page are pre-publication and may change.

Background

ZDI buys or receives vulnerability reports from researchers, notifies the vendor and publishes an advisory after a deadline. Its upcoming-advisories page shows reported and deadline dates that are exactly 120 days apart for every entry we saw; that is our arithmetic, and the page links to ZDI's disclosure policy rather than spelling the period out. For Linux, the normal route is the private security list, where kernel developers prepare fixes before details are public.

The kernel's SMB server has been a repeated subject of ZDI work. ZDI advisories ZDI-24-1456 (a ksmbd session race condition, coordinated release on 5 November 2024) and ZDI-24-1688 (a PreviousSessionId race condition, released 12 December 2024) both concerned ksmbd, and both needed authentication. A 2026 advisory, ZDI-26-573, covers a ksmbd out-of-bounds read leaking information and says Linux has issued an update. The best-known earlier case, CVE-2022-47939 (ZDI-22-1690, December 2022), was scored CVSS 10.0, according to Wiz's write-up. The pattern matters here: ksmbd is a network-facing code path inside the kernel, so bugs in it are exposed to remote attackers when it is enabled.

For help reading the scores in this story, see what a CVSS score means.

How it works

The two remote-code-execution bugs are in the kernel's SMB handling. SMB is the file-sharing protocol used by Windows networks and by many NAS boxes. ksmbd is a server for it that runs inside the kernel for speed rather than as a user-space daemon like Samba. Code that parses network input in kernel space is high stakes: a memory-safety bug there runs with kernel privileges. An integer underflow can make a length calculation wrap around to a huge number, and a race condition lets two threads touch the same object at once, which can leave a freed object in use. Those are the classes of bug named in the reports; the details of each exploit are not public and we do not speculate about them.

The local privilege escalation bugs are different in exposure. An attacker needs the ability to run code on the machine, for example through a compromised account, a container, or another bug. They matter most on shared systems and as the second step in a chain.

What it means

For file-server and NAS operators, the SMB bugs are the urgent part: a remotely reachable kernel bug rated 9.0 on an exposed port 445 would be a serious risk, even though we have no report of exploitation. Cutting off network exposure is the immediate mitigation.

For cloud and virtualisation teams, vmwgfx is only in play on VMware guests, and the NVMe target bug only where nvmet is used. Most Linux servers will not run either.

For the kernel process, the episode shows how disclosure norms depend on where a report is sent. The reports are on a public archive that anyone can read, and the kernel team says it cannot act on a report without a patch or private notice. Public posting shortens the time between disclosure and any fix, which is why the reply from the kernel side was about the channel. Whether ZDI will change its handling is not stated anywhere we could find.

What we don't know yet

  • Whether the posting was truly accidental. Phoronix and Slashdot say so; we found no statement from ZDI or Trend Micro.
  • Whether any of these flaws are being exploited. None of the sources we read says so.
  • CVE identifiers. The sources we could read use only ZDI IDs.
  • Which kernel versions are affected, and when fixes reach mainline and stable releases. The SMB Direct patch is described as sitting in a branch for Linux v7.5.
  • Whether the four lower-rated bugs have patches in progress beyond what is noted for skb_zerocopy.
  • The original lore.kernel.org messages could not be opened from our environment; we relied on Phoronix, the Openwall archive and ZDI's page, so details of the five other reports are as Phoronix lists them.

What to watch next

Watch the kernel security and stable announcements, distribution advisories that cite these ZDI IDs, and ZDI's own advisories page, where the final scores and CVE numbers will appear. We will add a dated update to this article if fixes or CVEs are published.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next