Details of six unpatched Linux kernel vulnerabilities landed on a public mailing list instead of a private security one, and two of them carry a CVSS score of 9.0. CVSS is the standard 0-to-10 severity scale for security flaws.
According to Michael Larabel's reporting, several reports arrived overnight on the public list. They seemingly came from Trend Micro's Zero Day Initiative (ZDI), a program that pays bug bounties to outside researchers. Greg Kroah-Hartman, who maintains the kernel's stable branch, answered each report individually and asked the senders to fix their submission process. None of the flaws have been patched in the main kernel.
The list:
- ZDI-CAN-33549 (CVSS 9.0): a remote code execution bug in SMB Direct, caused by an integer underflow. A patch sits in a Git branch aimed at Linux v7.5, and will presumably be rushed to mainline.
- ZDI-CAN-33774 (CVSS 9.0): a race condition in KSMBD that can lead to remote code execution.
- ZDI-CAN-33367: a flaw in skbuff skb_zerocopy that allows local privilege escalation. Kernel developers had already received a report on the same issue from another source, and a patch is expected soon.
- ZDI-CAN-34068: an out-of-bounds write in the VMWGFX VMware graphics driver, leading to local privilege escalation.
- ZDI-CAN-34076: an uninitialized resource in NVMET that leaks information.
- ZDI-CAN-32005: a stack buffer overflow in search-domain TCP queries, leading to local privilege escalation. It was posted to the list a day earlier.
The usual practice is coordinated disclosure: report privately, patch, then publish. This reversed the order, so attackers can read the details before fixes ship. The two 9.0 flaws are the sharpest worry because they can be exploited remotely. The local privilege escalation bugs matter less on a single-user gaming PC, since an attacker needs to be running code on the machine already.
Some of the fixes are being tested or queued in beta or -next branches, which is why the advice is to consider a beta channel on SteamOS or another distro. That trades one risk for another, since beta software has its own bugs. The source does not say which distros have picked up the queued patches, so checking your distro's changelog is the practical step. The accident also leaves a question for ZDI about how reports went to the wrong list.