Trend Micro accidentally disclosed multiple unpatched Linux Kernel vulnerabilities, suspected of operating errors when sending emails

Abstract:

The ZDI team, a zero-day vulnerability program owned by network security company Trend Micro, recently copied multiple vulnerability reports to the public Linux Kernel Mailing List, including two remote code execution vulnerabilities with scores as high as 9.0. Some of the vulnerabilities here have not been fixed and should not be made public. Judging from the email header information, it seems that the report was sent to the kernel security team and was accidentally copied to the public list.

Five kernel vulnerabilities are involved in the report:

Public report ZDI-CAN-33549 describes an SMB Direct integer underflow issue that could lead to remote code execution. The triggering environment listed in the report requires SMB Direct, RDMA devices, and shareable directories to be enabled.

ZDI-CAN-33774 involves a race condition in the kernel SMB server KSMBD. This vulnerability may also lead to remote code execution. ZDI-CAN-33549 and 33774 are both vulnerabilities in the remote code execution category, and both have CVSS 4.0 scores of 9.0 (severity).

Other reports involve local privilege escalation in network code, out-of-bounds writes in VMware virtual graphics drivers, and information leakage in NVMe target subsystems. There is also a ConnMan buffer overflow vulnerability, but this is not a kernel vulnerability.

It is suspected that the security team accidentally made it public during operation:

ZDI's pending announcement page lists the above kernel vulnerability report as notifying the Linux kernel team on October 21 and planning to publicly release vulnerability details on February 18, 2027; the planned release date corresponding to the ConnMan report is February 16, 2027.

At present, the relevant fixes have not yet been merged into the mainline version of the Linux Kernel. It can be seen that this is purely an operational error that caused the vulnerabilities to be disclosed in advance. It is unknown whether the early disclosure of these vulnerabilities will cause potential harm to the Linux ecosystem.