Kernel Devs Lose It When 4 CVEs Were Published To The LKML

Summary

The video criticizes Trend Micro’s Zero Day Initiative (ZDI) for publicly posting six Linux-kernel vulnerability reports to the Linux Kernel Mailing List (LKML), rather than first using the kernel’s private security-reporting address, security@kernel.org. The reports were posted without patches, which the narrator says was inconsistent with responsible-disclosure practices. Two of the vulnerabilities were rated CVSS 9.0.

Reported vulnerabilities

The six issues described were:

• An integer-underflow flaw in SMB Direct that could allow remote code execution. A patch existed in a development branch intended for a future kernel release.
• A race condition in ksmbd that could allow remote code execution.
• A zero-copy flaw involving skb in network code that could allow local privilege escalation.
• An out-of-bounds loop in the VMware graphics driver that could allow local privilege escalation.
• A stack-buffer overflow in a TCP query path that could allow local privilege escalation.
• An uninitialized resource in nvmet that could disclose information.

Response and disclosure concerns

Kernel developers Greg Kroah-Hartman and Peter Zijlstra objected to the public submissions. Zijlstra’s response was particularly sharp, saying that ZDI had repeatedly been directed to the relevant documentation.

ZDI replied that it had submitted many kernel cases over the years using a similar report format, disputed the criticism, and said it could not provide patches. The narrator argues that the central issue was not the report format, but the decision to disclose the reports publicly before following the private process.

Broader implications

The video raises broader concerns about vulnerability disclosure in open-source projects. Security researchers—and increasingly, AI-assisted tools—may independently discover the same flaws, making confidentiality harder to maintain.

In a public codebase, a security fix can itself reveal a vulnerability. Developers therefore need to prepare and distribute critical patches quickly, including to Linux distributions. The narrator suggests there may be no reliable way to keep significant kernel security changes private for long.

Main speakers and sources

• Brodie Robertson: Narrator
• Greg Kroah-Hartman and Peter Zijlstra: Linux-kernel developers quoted in the discussion
• Phoronix: Coverage of the reported vulnerabilities
• Trend Micro’s Zero Day Initiative: Reporting organization