# Unpatched Linux Kernel Flaws (KSMBD Pre-Auth RCE ZDI-CAN-33774 / ZDI-CAN-33549, skb_zerocopy LPE and others) Accidentally Disclosed on Public Mailing Lists

> Trend Micro's Zero Day Initiative accidentally copied six unpatched vulnerability reports to public Linux kernel mailing lists on 20-21 October 2026, including two CVSS 9.0 remote code execution flaws in KSMBD, the in-kernel SMB server. No CVE IDs had been assigned and no fixes were in the mainline kernel at the time of reporting; public reproduction details exist for several of the bugs.

- **Published:** 2026-10-23T02:27:37Z
- **Last reviewed:** 2026-10-23T02:27:37Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4206
- **ID:** TL-2026-4206
- **Severity:** CRITICAL (CVSS 9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-26592

## Description

On 20 October 2026 (ConnMan) and 21 October 2026 (five kernel reports), Trend Micro's Zero Day Initiative (ZDI) sent vulnerability reports intended for the private security@kernel.org list and also copied public lists including linux-kernel (LKML), linux-cifs, netdev and dri-devel. The reports were published with KASAN traces, code paths and, for some, full proof-of-concept source, before any patch or CVE existed. Stable-kernel maintainer Greg Kroah-Hartman replied to several reports criticising the public submission and the absence of patches. Per pwn.watch, formal ZDI advisories are scheduled for February 2027. Cyber Kendra attributes the finding to TrendAI, Trend Micro's AI vulnerability scanner.

The two highest-rated flaws are in KSMBD (the Linux in-kernel SMB3 server, off by default upstream and mostly seen on NAS devices and ARM boards such as Armbian; Red Hat Enterprise Linux does not ship it by default). ZDI-CAN-33774 (CVSS 9.0) is a pre-authentication race in KSMBD's protocol handler dispatch: a burst of short SMB1 packets followed by an SMB2 packet in the same TCP write on port 445 causes workers to process SMB1 data with the SMB2 handler, reading past the end of the shorter buffer. TuxCare reports this leaks about 28 bytes of kernel heap per attempt and can crash the kernel; pwn.watch states exploitation needs a guest-accessible share. A fix (commit 68f410faedaf) sits in the ksmbd maintainer tree but not mainline. ZDI-CAN-33549 (CVSS 9.0) is an integer underflow in the SMB Direct (RDMA) path: a client supplies RDMA buffer descriptors whose first entry is longer than the declared payload, wrapping the server's size counter so a later memory copy overruns an allocated buffer (heap overflow of up to about 8 KB per TuxCare). It requires CONFIG_SMB_SERVER_SMBDIRECT, an RDMA-capable interface and a writable share; a fix is reportedly queued for Linux 7.5 (Stefan Metzmacher's for-7.5/smbdirect branch, unconfirmed).

The remaining reports: ZDI-CAN-33367 (CVSS 7.8) is a local privilege escalation in skb_zerocopy() where the SKBFL_SHARED_FRAG guard flag is not carried over, allowing in-place ESP decryption to write to page-cache pages of read-only files. TuxCare reports it bypasses the May 2026 Dirty Frag fix (CVE-2026-43284) and yields root on AlmaLinux 8/9/10, CloudLinux 9/10, Debian 12/13 and Ubuntu 24.04/26.04 (including AppArmor restrictions); a one-line patch was posted to netdev on 22 October but not merged. ZDI-CAN-34068 (vmwgfx, out-of-bounds write LPE, CVSS 8.8) and ZDI-CAN-34076 (nvmet NVMe-oF target, uninitialized memory information disclosure, CVSS 8.6) have little published technical detail. ZDI-CAN-32005 is a stack buffer overflow in the ConnMan network daemon (not a kernel component). Testing was reported on Linux 7.3-rc1/rc3 (Debian trixie); full affected-version ranges were not disclosed.

No in-the-wild exploitation has been reported in the sources reviewed. Status ACTIVE reflects the unpatched, publicly documented state. Defenders should confirm whether KSMBD is loaded or enabled, remove it where unneeded, keep SMB (TCP 445) off untrusted networks, and restrict unprivileged user namespaces pending distribution fixes.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.001 Valid Accounts: Default Accounts
- T1499.004 Endpoint Denial of Service: Application or System Exploitation

## Sources

- [Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List (Cyber Security News)](https://cybersecuritynews.com/linux-kernel-flaws-accidentally-disclosed/)
- [Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes (The Hacker News)](https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html)
- [Linux Kernel skb_zerocopy Zero Day Gets Root on AlmaLinux, Debian and Ubuntu and Bypasses the Dirty Frag Fix (TuxCare)](https://tuxcare.com/blog/zdi-ksmbd-bugs-cve/)
- [Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (pwn.watch)](https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml)
- [Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List (Phoronix)](https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities)
- [Linux KSMBD RCE Flaws Disclosed Unpatched by Trend Micro ZDI (Cyber Kendra)](https://www.cyberkendra.com/2026/10/linux-ksmbd-rce-flaws-zdi-public-mailing-list.html)
- [Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List (Slashdot)](https://it.slashdot.org/story/26/10/22/1612227/several-linux-kernel-vulnerabilities-accidentally-posted-to-public-kernel-mailing-list)
- [Unpatched Linux kernel vulnerabilities accidentally emailed to public mailing list (Neowin)](https://www.neowin.net/news/unpatched-linux-kernel-vulnerabilities-accidentally-emailed-to-public-mailing-list/)
- [ZDI-24-195: Linux Kernel ksmbd TCP Connection Race Condition RCE (CVE-2024-26592), prior ksmbd race for context](https://www.zerodayinitiative.com/advisories/ZDI-24-195/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4206