GoKawiilZero Day Initiative accidentally leaks unpatched Linux kernel flaws on public mailing list
Trend Micro's Zero Day Initiative mistakenly sent several Linux kernel vulnerability reports to the public Linux kernel mailing list instead of the private security list. The disclosed issues include two CVSS 9.0-rated bugs in SMB Direct and KSMBD that could enable remote code execution, plus additional flaws in networking code, VMware's graphics driver, and NVMe target code. Kernel maintainer Greg Kroah-Hartman responded to each report questioning why they were posted publicly, and most of the flaws remain unpatched in mainline, though some fixes are in testing or queued branches.
GoKawiil's interpretation of the reporting above, not reported fact.
Public exposure of unpatched vulnerabilities, especially ones with high severity scores, could give attackers a head start before fixes reach users, since exploit details are now visible to anyone rather than restricted to maintainers working on a private timeline. The incident may pressure kernel developers to expedite patches that would otherwise have followed a more gradual private disclosure and testing process. It also highlights ongoing strain on Linux's vulnerability handling as the volume of reported security issues continues to grow.
- Zero Day Initiative mistakenly posted multiple Linux kernel vulnerability reports to the public mailing list instead of the private security list.
- Two of the disclosed bugs, in SMB Direct and KSMBD, carry CVSS scores of 9.0 and could allow remote code execution.
- Most of the flaws remain unpatched in mainline Linux, though some fixes are already in testing or queued for upcoming releases.
Source: phoronix.com, 2026-10-22
Published there as: “Several Linux kernel vulnerabilities accidentally posted to public mailing list”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.