Zero Day Initiative accidentally posts unpatched Linux kernel flaws to public LKML

Trend Micro's Zero Day Initiative mistakenly disclosed several unpatched Linux kernel vulnerabilities on the public LKML instead of the private security list. Two flaws carry a CVSS score of 9.0 and allow remote code execution via SMB Direct and KSMBD; Greg Kroah-Hartman questioned each report's public submission.

• ZDI-CAN-33549: SMB Direct RCE from integer underflow, CVSS 9.0
• ZDI-CAN-33774: KSMBD race condition enabling remote code execution, CVSS 9.0
• ZDI-CAN-33367: local privilege escalation via skb_zerocopy, patch pending
• Also disclosed: VMWGFX, NVMET and TCP search-domain buffer overflow bugs