# Unpatched Linux kernel vulnerabilities with CVSS 9.0 scores exposed on public mailing list

> **Key takeaway:** Trend Micro's Zero Day Initiative accidentally posted multiple unpatched Linux kernel vulnerabilities to the public LKML instead of the private security list, including two CVSS 9.0 remote code execution flaws.

**Published:** 2026-10-22T10:05:53+00:00 
**Source:** Phoronix Benchmarks & Drivers 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/unpatched-linux-kernel-vulnerabilities-with-cvss-90-scores-e.html 

## Summary
Several Linux kernel vulnerability reports were mistakenly sent to the public Linux kernel mailing list rather than the private security mailing list. The disclosed flaws include two CVSS 9.0-rated remote code execution vulnerabilities in SMB Direct and KSMBD. None have been patched in mainline yet, though some fixes are in testing or queued for future releases. Greg Kroah-Hartman responded to each report questioning the public disclosure.

## The disclosed vulnerabilities
- **ZDI-CAN-33549**: SMB Direct integer underflow enabling remote code execution (CVSS 9.0); patch exists in a branch targeting Linux v7.5
- **ZDI-CAN-33774**: KSMBD race condition leading to remote code execution (CVSS 9.0)
- **ZDI-CAN-33367**: skbuff skb_zerocopy network code bug enabling local privilege escalation; duplicate report received last week, patch expected soon
- **ZDI-CAN-34068**: VMWGFX VMware graphics driver out-of-bounds write causing local privilege escalation
- **ZDI-CAN-34076**: Uninitialized resource in NVMET leading to information disclosure
- **ZDI-CAN-32005**: TCP query stack buffer overflow in search-domain code enabling local privilege escalation

## Why it matters
The premature public disclosure of unpatched high-severity kernel vulnerabilities gives attackers advance notice before fixes reach distributions. The SMB-related RCE flaws are particularly concerning for systems running file sharing services.