On October 22, 2026, several Linux kernel vulnerabilities were inadvertently posted to the public Linux kernel mailing list (LKML) instead of the private security mailing...
Trend Micro’s Zero Day Initiative mistakenly disclosed unpatched flaws, including two CVSS 9.0 remote code execution vulnerabilities.
What changed
On October 22, 2026, several Linux kernel vulnerabilities were inadvertently posted to the public Linux kernel mailing list (LKML) instead of the private security mailing list. Trend Micro’s Zero Day Initiative appears to have made the error, exposing unpatched flaws that could enable remote code execution through SMB Direct and KSMBD. The vulnerabilities, including two rated CVSS 9.0, were shared in excerpts from internal reports, though no official confirmation of the mistake has been issued.
What is confirmed
The accidental disclosure of vulnerabilities is confirmed, with specific details including:
- Two CVSS 9.0-rated flaws affecting SMB Direct and KSMBD, both capable of remote code execution.
- Patches for one vulnerability (ZDI-CAN-33549) are in a Git branch for Linux v7.5, though not yet merged into mainline.
- A second vulnerability (ZDI-CAN-33774) involves a race condition in KSMBD, with patches undergoing testing or queued in “-next” branches.
No official statement or acknowledgment from Trend Micro or the Linux kernel community has been identified at this time.
What to watch or do next
Users and administrators should monitor updates from the Linux kernel community for patches to the disclosed vulnerabilities. System administrators are advised to check if their environments are affected by SMB Direct or KSMBD components and apply mitigations if necessary. The Linux kernel community is expected to address the issue promptly, but no timeline for patching has been announced.
Frequently Asked Questions
Q1: Are the vulnerabilities already patched?
No official patches have been released for the disclosed vulnerabilities. One vulnerability has a patch in a Git branch for Linux v7.5, but it is not yet mainlined. The other is undergoing testing or queued for “-next” branches.
Q2: What is the CVSS score for the disclosed vulnerabilities?
Two of the vulnerabilities are rated CVSS 9.0, the highest score for critical remote code execution flaws.
Q3: Has Trend Micro or the Linux community acknowledged the mistake?
No official statement or acknowledgment has been identified at this time.