Linux Kernel Flaw Reports From ZDI Hit Public Lists

Reports describing unpatched Linux kernel vulnerabilities, two of them rated 9.0 on the CVSS severity scale, were copied to public kernel mailing lists late on 21 October by Trend Micro’s Zero Day Initiative (ZDI). The reports are meant to reach maintainers privately until a fix is ready. Greg Kroah-Hartman, whom Phoronix calls Linux’s second-in-command, replied to each one within hours: “For some reason you sent this to public lists, and did not include a patch, so there’s not much we can do with this,” he wrote in one reply on the kernel’s public archive.

Phoronix first reported the mistake, saying the reports went out “seemingly as an accident”. The messages in the archive show they were addressed to the kernel’s private security team but also copied to open lists, including the main Linux kernel list. That matters because anyone can read those lists, and the reports were written for maintainers, with technical detail to match.

Two of the flaws are in the kernel’s own SMB file server

The two most serious reports concern KSMBD, which the kernel’s documentation describes as a server that implements the SMB3 file-sharing protocol inside the kernel. ZDI rates both 9.0 and says both could allow remote code execution: one through an integer underflow in the SMB Direct code, the other through a race condition in how the server dispatches protocol messages. Only systems running KSMBD would be exposed to these two.

The other kernel reports are local flaws, which need an attacker to have some access to the machine already. ZDI describes an ownership bug in the networking stack’s socket-buffer code that could allow privilege escalation, rated 7.8. It also reports an out-of-bounds write in vmwgfx, the VMware graphics driver, which could allow privilege escalation, and an uninitialised resource in nvmet, the kernel’s NVMe target code, which could leak information.

Phoronix also listed a sixth report, sent a day earlier. The archived message shows it concerns ConnMan, a separate network-management program, and went to that project’s list rather than to the kernel.

Maintainers say several of the bugs already have fixes

The maintainers’ replies suggest the damage may be limited. On the KSMBD race condition, maintainer Namjae Jeon wrote that “this issue has already been fixed”, pointing to a commit in his development tree. On the SMB Direct bug, developer Stefan Metzmacher asked the researcher to test a branch being prepared for Linux 7.5, adding: “I guess it’s already fixed with that.”

On the networking bug, kernel developer Eric Dumazet said the kernel team had already received a report “with a patch from another source one week ago”, and that a patch “will be available soon”. Phoronix says the flaws have yet to be fixed in the main kernel tree, though some patches are being tested or queued. No one in the threads, or in Phoronix’s report, says any of the bugs are being exploited.

Kroah-Hartman’s complaint was as much about the missing patches as the public lists. “Again, no patch, and sent to a public list? Please fix your submission process…” he wrote in a second reply.

A process failure in a week already short of patching time

The episode exposes a gap between two disclosure systems. ZDI’s published policy gives vendors “four months (120 days)” to fix a bug before it publishes details. The kernel’s rules for reporting security bugs are tighter: the private security list “is not a disclosure channel”, fixes for publicly known bugs are released immediately, and any embargo normally lasts no more than seven days. Copying a report to an open list removes the private window altogether.

For organisations running Linux, the practical risk depends on configuration. The two remote flaws matter only where KSMBD is enabled, and the rest need local access. The bigger cost is to defenders’ time. Security teams must now track fixes for bugs whose details are public before distributions have shipped patches, in the same week as the PHP2Shell flaws in PHP, which attackers began probing before disclosure.

The volume of reports is also rising. Kernel developer Willem de Bruijn pointed ZDI to the kernel’s reporting guidance “for future reports”. Other projects are changing how they triage: curl, for example, will handle low and medium-severity reports in public from 26 October. The kernel moved to its 7.4 development cycle only days ago, after the release of Linux 7.3. ZDI, which also runs the Pwn2Own hacking contests we covered in our October cyber roundup, had not replied in the archived threads by Thursday afternoon.

The next marker is whether the KSMBD and networking fixes reach the main kernel tree and the stable releases that distributions ship. Under the kernel’s own rules for publicly known bugs, that should not wait.