The Zero Day Initiative (ZDI) team at Trend Micro accidentally disclosed several unpatched Linux kernel vulnerabilities by sending reports to the public Linux Kernel Mailing List. The incident appears to be a result of an email configuration error where internal reports were copied to the public list.
Among the exposed reports, two remote code execution vulnerabilities received a CVSS 4.0 score of 9.0. One, identified as ZDI-CAN-33549, involves an integer underflow in SMB Direct that requires specific conditions like RDMA devices and shared directories to trigger.
The second critical vulnerability, ZDI-CAN-33774, relates to a race condition in the KSMBD kernel SMB server. Other disclosed reports cover local privilege escalation in network code, out-of-bounds writes in VMware virtual graphics drivers, and information leaks in the NVMe target subsystem.
The ZDI portal indicates that the Linux kernel team was notified of these issues on October 21. The original plan was to publicly release the vulnerability details on February 18, 2027. A separate report regarding a ConnMan buffer overflow was also leaked, with a planned disclosure date of February 16, 2027.
As of now, the necessary security patches for these vulnerabilities have not been merged into the Linux kernel mainline. The premature disclosure stems from an operational error, raising concerns about potential risks to the Linux ecosystem.
