The fastest way to turn a quiet patch Tuesday into a bad week is to publish the bug before the fix. That's roughly what happened on October 21, 2026, when Trend Micro's Zero Day Initiative — the outfit that pays researchers for responsibly disclosing bugs — accidentally emailed several unpatched Linux kernel vulnerability reports to the public kernel mailing list (LKML) instead of the private security list.

Greg Kroah-Hartman, the kernel's stable maintainer, did not hide his irritation. In replies on the public archive he called out the mistake and told the researchers to fix their submission process, fast. The genie was already out: detailed reports describing the flaws were sitting in a public archive for anyone — and any attacker — to read.

What leaked

Six flaws were laid out in public before any patch existed, per Phoronix's coverage of the incident:

  • ZDI-CAN-33549 — CVSS 9.0. Integer underflow in KSMBD's SMB Direct path allows remote code execution. It needs a perfect storm: an RDMA-capable interface (real hardware or the software rxe driver), a writable KSMBD share, and a client negotiating SMB Direct. A fix exists in a branch aimed at Linux 7.5 and will likely be expedited.
  • ZDI-CAN-33774 — CVSS 9.0. A race in how KSMBD assigns its packet handler table: a burst of short SMB1 packets followed by an SMB2 packet in the same TCP write makes worker threads handle SMB1 data with an SMB2 handler, reading — and potentially writing — past buffer ends. This one needs no authentication, just a reachable KSMBD server on port 445.
  • ZDI-CAN-33367 — skb_zerocopy bug in the networking stack leading to local privilege escalation. Kernel netdev already received the same bug from a separate reporter with a patch; as of October 22 a fix was posted to netdev for review, not merged. TuxCare verified working root exploits on AlmaLinux 8–10, CloudLinux 9/10, Debian 12/13, and Ubuntu 24.04/26.04.
  • ZDI-CAN-34068 — out-of-bounds write in the VMWGFX VMware graphics driver, local privilege escalation.
  • ZDI-CAN-34076 — uninitialized resource in the NVMET code, information disclosure.
  • ZDI-CAN-32005 — stack buffer overflow in search-domain TCP queries, local privilege escalation. This one was posted a day earlier.

Neither of the two critical KSMBD flaws had a CVE identifier as of October 22, and neither had a named fix in mainline or linux-next. The kernel project assigns CVEs only after a fix reaches a stable tree — so for now, the ZDI-CAN numbers are what you track.

The operator's checklist

The good news first: KSMBD is the in-kernel SMB server. Most file servers run Samba in userspace, not KSMBD. If you've never set it up, you probably aren't exposed. Check anyway:

BASH
lsmod | grep ksmbd

If that returns nothing, the two 9.0s don't touch you — move on to the skb_zerocopy item below. If the module is loaded, decide now whether you actually need it:

  1. Don't need it? Kill it. Unload it with modprobe -r ksmbd, blacklist it (echo "blacklist ksmbd" | sudo tee /etc/modprobe.d/ksmbd.conf), and make sure nothing restarts it at boot. Removing attack surface beats waiting for patches.
  2. Need it? Harden the edges. Firewall port 445 down to the subnets that must have it. If you don't use SMB Direct, don't give the machine an RDMA-capable interface — without it, ZDI-CAN-33549 can't fire. Lock share ACLs; the writable-share requirement means read-only shares are a smaller target.
  3. Watch the stable trees, not the headlines. The fix for the SMB Direct flaw is being rushed from the 7.5 branch toward mainline. Once it merges, expect stable backports to 7.3.x / 7.2.x and distro advisories within days-to-weeks — and apply them immediately, because attackers now have a public description of the bug to reverse-engineer against.
  4. The skb_zerocopy bug is the sleeper. It doesn't need exotic hardware, and it's verified working on the exact distros many of you run (Debian 12/13, Ubuntu 24.04/26.04, AlmaLinux). On multi-user machines or containers, local privilege escalation is a real step in an attack chain. Track the netdev patch and your distro's advisory.

There's a process lesson here too, and it's not about ZDI's typo. Coordinated disclosure exists precisely so the patch ships before the writeup. Every sysadmin who lived through the early dump of a major bug knows the difference: when the fix lands first, it's an update notification. When the bug lands first — as it did here — it's a countdown. Until the fixes arrive, the responsible move is the boring one: shrink the surface, restrict the exposure, and keep your eyes on the stable tree.

Sources

  • Neowin — "Unpatched Linux kernel vulnerabilities accidentally emailed to public mailing list" (Oct 22, 2026): https://www.neowin.net/news/unpatched-linux-kernel-vulnerabilities-accidentally-emailed-to-public-mailing-list/
  • The Hacker News — "Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes" (Oct 22, 2026): http://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html
  • TuxCare — "Linux Kernel skb_zerocopy Zero Day Gets Root on AlmaLinux, Debian and Ubuntu" (timeline and verification): https://tuxcare.com/blog/zdi-ksmbd-bugs-cve/