AI News Feed
Market watch
Le Monde Reports 96% of Coral Reefs 'Critically Endangered', at Risk of Collapse Within 50 YearsMicrosoft admits October Windows 11 update failed to fix Always On VPN bugiOS 27.2 to Bring Design Changes to Apple Music and BooksUK Must Prepare for State-Sponsored Attacks on Infrastructure, Streeting SaysBill Gates warns of two decades of ‘tumultuous’ AI disruptionRailway Urges All Users to Rotate Keys After Cyberattack Exposes Some Customer Secrets
Le Monde Reports 96% of Coral Reefs 'Critically Endangered', at Risk of Collapse Within 50 YearsMicrosoft admits October Windows 11 update failed to fix Always On VPN bugiOS 27.2 to Bring Design Changes to Apple Music and BooksUK Must Prepare for State-Sponsored Attacks on Infrastructure, Streeting SaysBill Gates warns of two decades of ‘tumultuous’ AI disruptionRailway Urges All Users to Rotate Keys After Cyberattack Exposes Some Customer Secrets
Cybersecurity

Zero Day Initiative Accidentally Posts Unpatched Linux Kernel Flaws to Public Mailing List

ZDI accidentally posted unpatched Linux kernel flaws, including two CVSS 9.0 bugs, to public LKML, Slashdot reports.

AI News Feed · 2026-10-23 00:41

According to Slashdot, the disclosures included ZDI-CAN-33549, a CVSS 9.0 integer underflow in SMB Direct that can lead to remote code execution. A patch for that issue was in a Git branch intended for Linux v7.5 and would presumably be expedited to reach mainline, Slashdot reported. ZDI-CAN-33774, a race condition in KSMBD, was also rated CVSS 9.0 and could lead to remote code execution.

The postings also covered ZDI-CAN-33367, a flaw in skbuff skb_zerocopy in the network code that can lead to local privilege escalation. Slashdot reported that Linux kernel developers had received a security report from another source last week about the same issue and that a patch was expected soon. ZDI-CAN-34068 involved an out-of-bounds write in the VMWGFX VMware graphics driver that can lead to local privilege escalation, while ZDI-CAN-34076 was described as an uninitialized resource in NVMET code leading to information disclosure.

Slashdot also reported that ZDI-CAN-32005 had been posted to the mailing list a day earlier. That flaw involved a stack buffer overflow in a search-domain TCP query and could lead to local privilege escalation.

Phoronix, cited by Slashdot, described the public posting as seemingly a mistake. Greg Kroah-Hartman, described by Phoronix as Linux's second-in-command, responded to each report by asking about its submission to the public mailing list, according to Slashdot.