On Oct 21 (UTC) Trend Micro's Zero Day Initiative sent several Linux kernel vulnerability reports to the private [email protected] address but copied public LKML and subsystem lists, so code paths, KASAN traces and reproduction details are now public. Greg Kroah-Hartman replied on-list asking ZDI to fix its submission process. The reports carry ZDI tracking IDs only; no CVEs have been assigned.

• ZDI-CAN-33774 (CVSS 9.0, AV:N/AC:H/PR:N): a race in ksmbd, the in-kernel SMB server. Protocol ops are chosen when a request is queued but used when it is handled, so a short SMB1 buffer can be parsed as an SMB2 header. That leaks heap memory, and ZDI describes a path to an out-of-bounds write. It needs a won race and a guest share. The ksmbd maintainer says it is already fixed in his tree (commit 68f410faedaf), but not yet in a mainline or stable release.
• ZDI-CAN-33549 (CVSS 9.0): an integer underflow in ksmbd's SMB Direct (RDMA) path. It needs an RDMA device (including the software rxe driver), a writable share and SMB Direct. Per Phoronix a fix sits in a branch aimed at Linux 7.5.
• Also posted: an skb_zerocopy local privilege escalation (ZDI-CAN-33367), a vmwgfx out-of-bounds write LPE (ZDI-CAN-34068), an nvmet info leak (ZDI-CAN-34076) and, a day earlier, ZDI-CAN-32005.

Only hosts that actually run ksmbd (not user-space Samba) are exposed to the two RCEs. ksmbd is not enabled by default on many distributions.