Multiple Linux kernel vulnerabilities were inadvertently disclosed on the Linux Kernel Mailing List (LKML) by Trend Micro's Zero Day Initiative (ZDI). These reports were made public before the corresponding patches were fully integrated into the mainline kernel, with some fixes currently undergoing testing or residing in candidate branches.
The vulnerabilities span several kernel subsystems, including network communication, file sharing, storage services, and virtualization graphics drivers. Notably, the SMB Direct vulnerability (ZDI-CAN-33549) and the KSMBD vulnerability (ZDI-CAN-33774) both carry a CVSS score of 9.0, posing a risk of remote code execution.
Other identified issues include ZDI-CAN-33367 in the skb_zerocopy network code, which may allow for local privilege escalation. Additionally, the VMWGFX graphics driver contains an out-of-bounds write vulnerability (ZDI-CAN-34068), while the NVMET code includes an uninitialized resource issue (ZDI-CAN-34076) that could lead to information leakage.
The leaked reports also included ZDI-CAN-32005, a stack buffer overflow in TCP query processing. While developers are working on patches for these flaws, the status of the fixes remains inconsistent across the affected components. The specific cause behind the accidental public disclosure of these internal reports remains unconfirmed.
