[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-six-unpatched-linux-kernel-bugs-leaked-to-a-public-mailing-list":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12243,"six-unpatched-linux-kernel-bugs-leaked-to-a-public-mailing-list","Six Unpatched Linux Kernel Bugs Leaked to a Public Mailing List","Six reports, two rated 9.0 on CVSS, went to a public list by accident, and only some have patches queued in beta or -next branches.","Details of six unpatched Linux kernel vulnerabilities landed on a public mailing list instead of a private security one, and two of them carry a CVSS score of 9.0. CVSS is the standard 0-to-10 severity scale for security flaws.\n\nAccording to Michael Larabel's reporting, several reports arrived overnight on the public list. They seemingly came from Trend Micro's Zero Day Initiative (ZDI), a program that pays bug bounties to outside researchers. Greg Kroah-Hartman, who maintains the kernel's stable branch, answered each report individually and asked the senders to fix their submission process. None of the flaws have been patched in the main kernel.\n\nThe list:\n\n- **ZDI-CAN-33549** (CVSS 9.0): a remote code execution bug in SMB Direct, caused by an integer underflow. A patch sits in a Git branch aimed at Linux v7.5, and will presumably be rushed to mainline.\n- **ZDI-CAN-33774** (CVSS 9.0): a race condition in KSMBD that can lead to remote code execution.\n- **ZDI-CAN-33367**: a flaw in skbuff skb_zerocopy that allows local privilege escalation. Kernel developers had already received a report on the same issue from another source, and a patch is expected soon.\n- **ZDI-CAN-34068**: an out-of-bounds write in the VMWGFX VMware graphics driver, leading to local privilege escalation.\n- **ZDI-CAN-34076**: an uninitialized resource in NVMET that leaks information.\n- **ZDI-CAN-32005**: a stack buffer overflow in search-domain TCP queries, leading to local privilege escalation. It was posted to the list a day earlier.\n\nThe usual practice is coordinated disclosure: report privately, patch, then publish. This reversed the order, so attackers can read the details before fixes ship. The two 9.0 flaws are the sharpest worry because they can be exploited remotely. The local privilege escalation bugs matter less on a single-user gaming PC, since an attacker needs to be running code on the machine already.\n\nSome of the fixes are being tested or queued in beta or -next branches, which is why the advice is to consider a beta channel on SteamOS or another distro. That trades one risk for another, since beta software has its own bugs. The source does not say which distros have picked up the queued patches, so checking your distro's changelog is the practical step. The accident also leaves a question for ZDI about how reports went to the wrong list.","[\"linux\",\"kernel\",\"vulnerabilities\",\"steamos\"]","2026-10-23T09:26:40.000Z","2026-10-23T10:31:38.595Z","2026-10-23T10:31:38.758Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the unsupported claim that Larabel covered the incident on October 22: the source gives no date and says only that Phoronix reported it 'yesterday'. Either drop the date or describe the timing the way the source does, and re-check the rest of the draft for any other details the source doesn't support.","resolved","security",[32,33,34,35],"linux","kernel","vulnerabilities","steamos",[37],{"name":38,"url":39},"PCGamer","https:\u002F\u002Fwww.pcgamer.com\u002Fhardware\u002Fa-public-outing-of-severe-and-unfixed-linux-kernel-vulnerabilities-should-have-you-thinking-of-updating-your-steamos-or-other-distros-to-beta-branches\u002F",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7069,"2026-10-23T12:56:30.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1060,"2026-10-23T11:00:00.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",576,"2026-10-23T12:26:23.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",568,"2026-10-23T12:30:00.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",290,"2026-10-23T12:08:05.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",289,"2026-10-23T08:23:42.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",216,"2026-10-22T22:12:19.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Startups","startups",147,"2026-10-23T12:44:27.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Software","software",142,"2026-10-23T00:09:58.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",122,"2026-10-21T16:00:00.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",99,"2026-10-23T11:30:22.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",88,"2026-10-22T22:25:33.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]