Trend Micro Accidentally Discloses Unpatched Linux Kernel Flaws on Public List
Six Linux kernel vulnerabilities, including two rated CVSS 9.0 for the KSMBD server, were posted to a public mailing list by error, exposing details before patches were ready.
Key points
- Trend Micro’s Zero Day Initiative mistakenly sent six vulnerability reports to the public Linux kernel mailing list instead of a private security channel.
- Two flaws in the KSMBD file server are rated CVSS 9.0 and could allow remote code execution or privilege escalation before fixes are widely available.
- Kernel maintainer Greg Kroah-Hartman questioned the disclosure method, as no patches were included in the initial public submissions to the mainline tree.
Trend Micro’s Zero Day Initiative accidentally posted technical details of six unpatched Linux kernel vulnerabilities to a public mailing list in October 2026, according to reports from Cyber Security News and Phoronix. The submission occurred overnight and reached the public Linux Kernel Mailing List rather than the private security mailing list intended for coordinated disclosure. This routing error exposed sensitive technical information before fixes were ready for mainline integration.
The disclosed reports include two critical flaws rated CVSS 9.0 that affect the KSMBD file server, an optional SMB file-sharing component built into the Linux kernel, according to Cyber Security News. These vulnerabilities could allow a remote attacker to execute code on affected systems. Other reports submitted by the ZDI team describe risks related to local privilege escalation and information disclosure. The CVSS scores indicate high severity, placing the flaws in the critical range for remote exploitation potential.
Context and Background
Linux kernel maintainer Greg Kroah-Hartman publicly questioned why some submissions were sent to the general mailing list without accompanying patches, according to Cyber Security News. The reports credit Trend Micro’s AI scanner for identifying the bugs, and current kernel guidance treats AI-found bugs as already public, which may have influenced the routing decision. As of October 23, 2026, Trend Micro had not publicly explained whether this was a simple mistake or a procedural choice, leaving the exact cause unclear.
One critical flaw, identified as ZDI-CAN-33774, involves a race condition in KSMBD that could lead to remote code execution, according to Cyber Security News. The report states that a mismatch in how the server handles queued network requests may cause memory to be read or written beyond its intended limits. The second critical flaw, ZDI-CAN-33549, affects the SMB Direct path within KSMBD. It stems from an integer underflow where a size value wraps around after subtraction, leading to incorrect length calculations and potential buffer overflows during memory operations.
Who Is Affected
The most urgent reports concern KSMBD, which is separate from Samba, the commonly used file-sharing software, meaning systems running Samba alone are not automatically affected by these specific findings, according to Cyber Security News. Operators must determine whether KSMBD is enabled and actively serving files on their Linux systems. The SMB Direct issue specifically concerns RDMA networking, so exposure depends on the server’s configuration and its use of that feature.
At the time of reporting, neither critical issue had a named fix in the mainline kernel or its integration tree, and no CVE identifiers had been assigned, according to Cyber Security News. A fix for ZDI-CAN-33549 was reportedly present in a development branch intended for Linux 7.5, but this does not mean it was available in released or distribution kernels. Kernel changes must reach stable and distribution releases before most users can install them, leaving a window of exposure.
What should you do?
Security teams should immediately verify whether their Linux systems have the KSMBD module enabled or loaded. If KSMBD is not required for business operations, administrators should disable or remove it to eliminate the attack surface associated with the disclosed remote code execution flaws. Organizations relying on SMB Direct over RDMA should review their network configurations to limit exposure to untrusted sources.
What to do and how to stay safe: Linux Kernel
- Audit running kernel modules to confirm if KSMBD is active on your servers.
- Disable or uninstall KSMBD if your infrastructure relies solely on Samba for file sharing.
- Monitor vendor channels and distribution update streams for confirmed patches.
- Review network access controls to restrict SMB traffic to trusted internal segments.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are systems running Samba affected by these new Linux kernel vulnerabilities?
No, because KSMBD is a separate component from Samba, so systems using only Samba are not automatically affected by these specific flaws.
Have CVE identifiers been assigned to these unpatched Linux kernel flaws?
No, as of the reporting period, no CVE identifiers had been assigned to these six vulnerabilities.
Is there a confirmed fix available for the critical KSMBD vulnerabilities?
No, neither critical issue had a named fix in the mainline kernel or its integration tree at the time of reporting.
