Developers from the Zero Day Initiative, a program by Trend Micro, accidentally leaked details of at least six critical Linux kernel vulnerabilities. The information was sent to the public Linux Kernel Mailing List instead of a secure address.
The vulnerabilities, all rated with a CVSS score of 9.0 or higher, remain unpatched. Among them is ZDI-CAN-33774 in the KSMBD module, which allows for remote code execution. Other identified flaws include ZDI-CAN-33549, ZDI-CAN-33367, ZDI-CAN-34068, ZDI-CAN-34076, and ZDI-CAN-32005.
Greg Kroah-Hartman, deputy to Linus Torvalds, criticized the incident and demanded changes to reporting processes. Standard procedure requires vulnerabilities to be disclosed only after patches are integrated into stable kernel releases.
Experts note that NAS servers and devices using the KSMBD module with port 445 exposed to untrusted networks are at the highest risk. Temporary mitigation involves disabling the module or blocking SMB via a firewall.
