Introduction
In coordinated disclosure, timing matters as much as the flaw itself. On 21 October 2026, Trend Micro's Zero Day Initiative (ZDI) sent five Linux kernel vulnerability reports addressed to the private kernel security list, with the public Linux Kernel Mailing List (LKML) and subsystem lists in copy, and a sixth report had gone out the same way the day before. None of the flaws was fixed in the mainline kernel at that point. Greg Kroah-Hartman answered each report asking why it was sent without a patch to a public list, and asked ZDI to fix its submission process ⚠️. Administrators now know the where and the how of these flaws before their distribution ships a fix.
Technical Context: What Was Reported
The reports span the in-kernel SMB server, the network stack and specific drivers 🖥️:
- Remote code execution in ksmbd: two reports rated CVSS 9.0 target ksmbd, the kernel's own SMB server. An integer underflow in SMB Direct requires an RDMA device, a writable share and SMB Direct enabled. A protocol dispatch race condition, where the handler for one SMB version runs on a buffer of another, needs a share with guest access. ZDI tested both on 7.3-rc3 🔓.
- skb_zerocopy in the network stack: a local privilege escalation. Kernel developers had already received a report of the same issue from another source the week before, and a patch was expected soon.
- Drivers and subsystems: an out-of-bounds write in the VMWGFX VMware graphics driver, leading to local privilege escalation, and an uninitialised resource in NVMET, the NVMe over Fabrics target, leading to information disclosure.
- TCP search-domain query: a stack buffer overflow leading to local privilege escalation, reported the day before the others.
- Patch status: for the SMB Direct underflow, a fix already sits in a branch prepared for Linux 7.5, and its maintainer asked the reporter to confirm it. The others had no fix in mainline at the time.
Practical Implications: Mitigation While Fixes Travel 🔧
The gap that matters is the time between a flaw becoming public and the distribution kernel that fixes it. With the reports on public lists, that gap is open for anyone who reads them. The two remote paths depend on ksmbd, which gives administrators a clear lever:
- Disable ksmbd where it is not required. Both remote code execution reports need this server; without it running, they are out of reach.
- Harden ksmbd where it stays. Disable SMB Direct when there is no RDMA hardware, and remove guest access from shares, which removes what each of the two reports requires.
- Track the distribution kernel updates. The local privilege escalation and information disclosure flaws are fixed only by a patched kernel, so the next distribution kernel release that carries them is the one to schedule.
Strategic Conclusion
Disable ksmbd today wherever it is not needed, because it is the single component behind both critical reports and the only part of the six that a configuration change takes off the table. For the rest, the protection is the kernel update itself.
The episode also shows why the kernel's disclosure process insists on the private list: a public copy hands the details to everyone at the same moment it reaches the people who can write the fix.
Original report by Michael Larabel published on Phoronix on 22/10/2026, with the original messages in the public LKML archive.
Fonte Original: https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities
