Six vulnerability reports attributed to Trend Micro’s Zero Day Initiative were copied to public Linux development mailing lists on October 21 and 22, while the kernel security list was also addressed, Next.ink reported. The public copies included code paths and KASAN traces, a kernel memory-error detector. Coverage was published on October 23, 2026.
The public lists included linux-kernel, linux-cifs, netdev and `dri-devel. The reports described potential remote code execution, local privilege escalation and information disclosure.
The two KSMBD reports
The two KSMBD findings were reported as CVSS 3.1 scores of 9.0. KSMBD is the Linux kernel’s SMB server component.
ZDI-CAN-33774 was described as a race condition in KSMBD’s packet processing. The reported trigger involved short SMB1 packets followed by an SMB2 packet in the same TCP write. The potential impact was remote code execution; an attacker was reported to need access to a share, but not authorization.
ZDI-CAN-33549 was described as an integer underflow in KSMBD’s SMB Direct path. Its reported conditions were an RDMA-capable interface, a writable KSMBD share and a client negotiating SMB Direct. SMB Direct is optional and disabled by default.
Four other reports
The other reports included ZDI-CAN-33367, ZDI-CAN-34068, ZDI-CAN-34076 and ZDI-CAN-32005. The first three were described as follows:
- ZDI-CAN-33367: a
skb_zerocopynetwork-code issue with potential local privilege escalation. - ZDI-CAN-34068: an out-of-bounds write in the
vmwgfxvirtual GPU driver, with potential local privilege escalation. - ZDI-CAN-34076: an uninitialized resource in
nvmet, with potential information disclosure.
What kernel guidance says about AI-assisted reports
Linux kernel security guidance says vulnerabilities found with AI assistance must be handled as public. It also cautions against publicly sharing a reproducer, the code or steps used to trigger a bug. Reports should include the affected version or commit, a detailed description, a reproducer or its status, and the triggering conditions; the guidance also calls for validating the issue and testing a proposed fix. The kernel’s security reporting guidance sets out these requirements.
Reported patch work
PC Gamer reported on October 23, 2026, that a patch for ZDI-CAN-33549 was in a Git branch intended for Linux v7.5. It also reported that some fixes were being tested or queued in beta or -next branches.
