Six reports from Trend Micro’s Zero Day Initiative (ZDI) concerning Linux kernel vulnerabilities appeared on the public Linux Kernel Mailing List (LKML) on October 21–22, 2026, rather than the private security channel. Phoronix and ADSLZone described the disclosure as apparently accidental. The reported issues involve six kernel components or code paths, with potential impacts including remote code execution, local privilege escalation and information disclosure.
How the reports appeared on public LKML
Phoronix reported that ZDI-CAN-32005 appeared on October 21, one day before the other five reports appeared on October 22. Phoronix also reported that Linux maintainer Greg Kroah-Hartman questioned why the submissions went to the public list.
What the six reports described
Phoronix’s October 22 account identified the following issues and potential impacts. CVSS, the Common Vulnerability Scoring System, rated ZDI-CAN-33549 and ZDI-CAN-33774 at 9.0.
| ZDI ID | Component or reported issue | Reported potential impact |
| ZDI-CAN-33549 | SMB Direct integer underflow | Remote code execution |
| ZDI-CAN-33774 | KSMBD race condition | Remote code execution |
| ZDI-CAN-33367 | skbuff skb_zerocopy network issue | Local privilege escalation |
| ZDI-CAN-34068 | Out-of-bounds write in the VMWGFX VMware graphics driver | Local privilege escalation |
| ZDI-CAN-34076 | Uninitialized resource in NVMET code | Information disclosure |
| ZDI-CAN-32005 | Stack-buffer overflow in a search-domain TCP query | Local privilege escalation |
Patch status reported on October 22
Phoronix reported on October 22, 2026, that no fix had reached the Linux mainline kernel by the time of publication. Some patches were being tested or queued in “-next” development branches. A patch for ZDI-CAN-33549 was in a Git branch intended for Linux v7.5.
The kernel project’s general guidance on AI-assisted findings
The Linux kernel project’s security-bugs guidance says to treat AI-assisted bug discoveries as public, not to post a reproducer publicly, and to report privately when unsure whether a finding qualifies for public disclosure. This is general reporting guidance.
