Several Linux kernel vulnerability reports were mistakenly sent to a public mailing list, exposing details of unpatched flaws before fixes were ready for the mainline kernel. Two of the issues carry CVSS 9.0 ratings.
The notices appear to be connected to Trend Micro’s Zero Day Initiative. Stable kernel maintainer Greg Kroah-Hartman replied to the reports individually and asked for the submission process to be corrected. At the time of disclosure, none of the six issues had been patched in the mainline kernel, though some fixes were being tested or queued in beta and -next branches.
Two disclosures describe remote-code-execution risks. ZDI-CAN-33549 involves an integer underflow in SMB Direct. A patch was already in a Git branch intended for Linux v7.5, but had not reached mainline. ZDI-CAN-33774 describes a KSMBD race condition. Both were rated CVSS 9.0.
ZDI-CAN-33367 concerns skb_zerocopy in the network code and could allow local privilege escalation. Kernel developers had received a separate report about the same issue the previous week, and a patch was expected soon.
Two other reports describe local privilege-escalation risks. ZDI-CAN-34068 concerns an out-of-bounds write in the VMWGFX VMware graphics driver, while ZDI-CAN-34076 involves an uninitialized resource in NVMET that could disclose information. ZDI-CAN-32005, posted to the mailing list a day earlier, describes a search-domain TCP query stack buffer overflow that could also allow local privilege escalation.
SteamOS and other Linux users can check their distribution’s security notices and beta-branch updates for the specific fixes. A beta or -next kernel may contain a patch before it reaches a stable release, but opting into a testing branch does not guarantee that it includes every fix discussed here.
Would you use a beta kernel for an earlier security fix, or wait for your distribution’s stable release? For updates on how these fixes move through testing and toward stable releases, stay connected on X, Bluesky, YouTube, Instagram, Steam, and Telegram.
