Multiple Linux Kernel Vulnerability Reports Accidentally Sent to Public Mailing List
Trend Micro's Zero Day Initiative erroneously published multiple Linux kernel vulnerability reports to the public LKML mailing list instead of a private security list. The unpatched upstream mainline kernel vulnerabilities have CVSS scores up to 9.0. Greg Kroah-Hartman sought explanations for each report, which included remote code execution in SMB Direct, a race condition in KSMBD, and other issues. Some patches are already in testing or queued for merging.
Multiple Linux Kernel Vulnerability Reports Were Accidentally Sent to a Public Mailing List
Trend Micro's Zero Day Initiative mistakenly sent multiple Linux kernel vulnerability reports to the public Kernel Mailing List (LKML) instead of a private security list. These vulnerabilities have not yet been fixed in the upstream mainline kernel, with some receiving a CVSS score as high as 9.0.
Linux's second-in-command, Greg Kroah-Hartman, replied to each report individually, asking why they had been submitted to the public list. The issues include remote code execution in SMB Direct, a race condition in KSMBD, and others. Some patches are already in testing or queued for merging.
Source: Phoronix via Philip (https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities)