Trend Micro's Zero Day Initiative (ZDI) sent at least six Linux kernel vulnerability reports to the public Linux Kernel Mailing List (LKML) rather than the private security mailing list. The disclosure appears to have been a routing mistake, not a deliberate act. Greg Kroah-Hartman, Linux's second-in-command, responded to each report asking why it had been posted publicly. Two of the vulnerabilities carry CVSS scores of 9.0 — the threshold for "critical." ZDI-CAN-33549 is an integer underflow in SMB Direct that enables remote code execution; a patch exists in a Git branch targeting Linux v7.5 but has not reached mainline. ZDI-CAN-33774 is a race condition in KSMBD, also enabling remote code execution. Both affect network-facing kernel subsystems, meaning exploitation doesn't require local access. The remaining four bugs are serious but lower-severity. ZDI-CAN-33367 is a skbuff skbzerocopy flaw in network code leading to local privilege escalation; kernel developers had already received an independent report on the same issue last week and expect a patch soon. ZDI-CAN-34068 hits the VMWGFX VMware graphics driver with an out-of-bounds write for local privilege escalation. ZDI-CAN-34076 is an uninitialized resource in NVMET code causing information disclosure. ZDI-CAN-32005, posted a day earlier, is a search-domain TCP query stack buffer overflow leading to local privilege escalation. The process failure here is straightforward but consequential. Responsible disclosure exists because attackers monitor public channels. Every hour between public disclosure and patch availability is an open window for exploitation. The two CVSS 9.0 bugs targeting SMB Direct and KSMBD are particularly dangerous because SMB services are widely deployed in enterprise and NAS environments, and remote code execution requires no local foothold. The incident raises a narrower governance question: how does a major security research organization like ZDI route reports to the wrong mailing list? Email misconfiguration, a new analyst, a broken automation pipeline — the cause hasn't been disclosed. But the Linux kernel security process depends entirely on the discipline of reporters using the right channel. There is no technical enforcement preventing public disclosure; the system runs on convention. Some patches are already in progress. The SMB Direct fix is queued in a branch for v7.5, and the skbzerocopy patch was expected before this disclosure accelerated the timeline. Others — particularly the KSMBD race condition — appear to have no public patch yet. The kernel security team is now in triage mode, deciding what to fast-track to mainline. The original article closes with a throwaway line about "AI fueled" bug reports, but nothing in the disclosed vulnerabilities or ZDI's process suggests AI involvement. The real story is a process breakdown in one of open-source infrastructure's most critical chokepoints: the boundary between private disclosure and public knowledge.
