Phoronix reported on 22 October that Trend Micro's Zero Day Initiative sent Linux kernel bug reports to the public kernel mailing list instead of the private security one. Phoronix called it a seeming accident. Greg Kroah-Hartman, the kernel's second-in-command, asked about each submission. Six flaws are listed. Two score 9.0 on CVSS, a 10-point severity scale. One is an integer underflow, a number that wraps to a wrong value, in SMB Direct. The other is a race condition, where two actions collide, in ksmbd. Both can lead to remote code execution.
The flaws are not yet patched in mainline, the main kernel code. Some fixes are being tested or queued in "-next" branches. The SMB Direct fix sits in a branch meant for Linux v7.5. For the skb_zerocopy bug, Phoronix says a patch is expected soon. The article does not say why the reports went to the wrong list. It gives no fix dates for the rest, and it does not say whether any flaw is being attacked.
A process slip put flaw details in public before mainline fixes existed. Remote code execution matters most, because the attacker needs no foothold on the machine first. Budget owners can ask three things. Do we expose ksmbd or SMB Direct? How fast can we ship kernel updates? Who tracks kernel advisories?