ZDI Leaks Critical Linux Kernel Vulnerabilities to LKML
The Zero Day Initiative (ZDI) team at Trend Micro recently experienced an operational mishap. Specifically, researchers inadvertently copied several confidential vulnerability reports to the public Linux Kernel Mailing List. Among these disclosures were two remote code execution flaws carrying severe CVSS scores of 9.0. Because maintainers have not yet patched these security defects, premature disclosure poses immediate risks to enterprise systems.
Accidental Public Disclosure via Mailing List
Email header telemetry reveals that analysts intended to deliver the vulnerability advisories to the private kernel security team. However, the sender accidentally included the public list in the carbon copy field. Consequently, full technical summaries appeared in the public LKML security disclosure thread before developers could construct defensive patches. Therefore, security administrators now face potential exposure while upstream maintainers work on formal fixes.
Five Kernel Security Flaws Exposed
The accidental transmission detailed five distinct kernel defects across diverse subsystems. Most notably, two issues enable unauthenticated remote code execution with critical severity.
Remote Code Execution in SMB Implementations
First, report ZDI-CAN-33549 details an integer underflow vulnerability within SMB Direct. Under specific conditions, exploiting this flaw allows remote adversaries to execute arbitrary code on vulnerable hosts. However, the attack requires active configurations featuring SMB Direct, RDMA network adapters, and accessible shared directories.
Similarly, report ZDI-CAN-33774 identifies a dangerous race condition in KSMBD, the in-kernel SMB file server. Like the previous flaw, this defect enables arbitrary remote execution. Both vulnerabilities received alarming CVSS 4.0 ratings of 9.0.
Privilege Escalation and Subsystem Weaknesses
Beyond remote execution flaws, the leak exposed three additional kernel issues. These include local privilege escalation in networking routines and an out-of-bounds write in VMware virtual graphics drivers. Additionally, the disclosure outlined an information leak in the NVMe target subsystem. Furthermore, the batch contained a buffer overflow report for ConnMan, a user-space connection management daemon.
Premature Disclosure and Operational Fallout
According to ZDI scheduling registries, researchers notified Linux kernel maintainers on October 21. In addition, formal coordinated disclosures were originally slated for February 18, 2027. Because upstream maintainers have not merged fixes into the mainline tree, the accidental leak leaves defenders in an awkward dilemma. Ultimately, administrators overseeing exposed SMB and RDMA configurations should audit system perimeters until official distributor updates arrive.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
