Phoronix reported that several Linux kernel vulnerability reports from the Zero Day Initiative appeared on public mailing lists before fixes were complete. They included remote code execution risks in SMB Direct and KSMBD, as well as privilege escalation and information disclosure issues. Some fixes were still in testing or development branches and had not reached all stable distributions. Kernel developers asked about the circumstances of the public submissions, but the specific reason, including whether it was a mistake, was not confirmed. Operators should assess exposure using the components they actually enable, their distribution’s security advisories, and the status of backported fixes.
Back to Tech
Tech
Several Linux kernel vulnerability reports go public before fixes are complete
A public mailing-list report or a development-branch patch does not establish that the distribution in use has been fixed.