Trend Micro's ZDI Sent Six Unpatched Linux Kernel Reports to a Public List

An unauthenticated network attacker could overflow kernel heap memory through ksmbd, the Linux in-kernel SMB server (only if the host builds SMB Direct support, has an RDMA device and exports a writable share). Trend Micro's Zero Day Initiative described the flaw in a report that reached the public linux-kernel mailing list on Wednesday, October 21, 2026, with no mainline patch.

The report, tracked as ZDI-CAN-33549, was sent at 21:16 UTC to security@kernel.org with linux-kernel@vger.kernel.org and linux-cifs@vger.kernel.org on copy, according to the archived message on lore.kernel.org. Phoronix counted at least six such reports and called the posting apparently accidental.

What the six reports describe

The two highest-rated reports carry a CVSS score of 9.0 with the vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. Both name ksmbd. The rest are local privilege escalations or an information leak. None has a CVE identifier in the archive; the numbers are ZDI tracking IDs.

ZDI tracking ID	Component	Impact	Status per Phoronix
ZDI-CAN-33549	ksmbd SMB Direct	Remote code execution, integer underflow	Fix in a branch for Linux v7.5
ZDI-CAN-33774	ksmbd protocol dispatch	Remote code execution, race condition	Unpatched
ZDI-CAN-33367	skbuff skb_zerocopy	Local privilege escalation	Patch expected
ZDI-CAN-34068	VMWGFX driver	Local privilege escalation, out-of-bounds write	Unpatched
ZDI-CAN-34076	NVMET Get Log Page	Information disclosure	Unpatched
ZDI-CAN-32005	Search-domain TCP query	Local privilege escalation, stack overflow	Unpatched

Phoronix said kernel developers had received a report on the skb_zerocopy issue from another source the previous week. It also said ZDI-CAN-32005 was posted a day before the others.

The preconditions are narrow

The score overstates the exposure for most machines. ZDI-CAN-33549 needs a kernel built with CONFIG_SMB_SERVER_SMBDIRECT=y, an RDMA device, a writable share and SMB Direct, which the report says is available on Ubuntu only. ZDI tested kernel 7.3-rc3 on Debian trixie, with the software RXE RDMA driver standing in for hardware.

ZDI-CAN-33774 needs a guest-accessible share and a race. The report says a queued 40-byte SMB1 buffer can be parsed as a 64-byte SMB2 header, which leaks 28 bytes of adjacent heap in a 77-byte error reply. It also describes a path to an out-of-bounds write. Neither source reports exploitation, and the archive does not show what, if anything, an attacker can do beyond the reproduction ZDI attached.

Timeline from the archive

• October 21, 21:16 UTC: ZDI-CAN-33549 sent to the kernel security list and, on copy, the public lists.
• October 21, 21:25 and 21:27 UTC: ZDI-CAN-34068 and ZDI-CAN-34076 follow.
• October 21, 22:16 UTC: Stefan Metzmacher, writing from a samba.org address, replies that ZDI-CAN-33549 is probably "already fixed" in his for-7.5/smbdirect branch, and asks the reporter to retest there.
• October 22, 06:44 CEST (04:44 UTC): kernel developer Greg Kroah-Hartman answers the VMWGFX and NVMET reports on the same list.

The NVMET reply reads in full: "Again, no patch, and sent to a public list? Please fix your submission process..." The message is copied to the NVMe target maintainers and to security@kernel.org.

The kernel's private security list exists so that a fix can be prepared before details are public. The first report arrived with a KASAN trace, an annotated code excerpt and a reproduction script attached, in an archive anyone can read. Related coverage of C-level memory bugs includes the musl regcomp overflows and 16 CVEs in DNS resolvers.

What operators should check

Hosts that do not run ksmbd are outside the preconditions of the first two reports. Where it is loaded, check whether the kernel was built with SMB Direct and whether an RDMA device is present, and note that the second report requires a guest-accessible share. Metzmacher's branch targets Linux 7.5; no release date for a mainline merge appears in either source. The next thing to watch is whether ZDI republishes the reports as advisories with CVE identifiers.