# Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

> **Open Intelligence Dossier** · First detected: 2026-10-23 00:00 UTC · Category: Technology

## Executive Summary
Two severe unpatched Linux kernel vulnerabilities with CVSS 9.0 scores have been disclosed publicly before any fixes became available.

## Intelligence Brief
According to technology coverage from multiple outlets including The Hacker News, VideoCardz.com, Neowin, Phoronix, Cyber Kendra, and BigGo Finance, the Linux kernel has been struck by two severe security flaws carrying a CVSS severity score of 9.0. Specifically, these critical issues involve the Linux KSMBD remote code execution components. The coverage documents that these high-severity vulnerabilities were posted directly to public mailing lists. This disclosure occurred before any official kernel fixes or patches had been developed and released to secure affected systems. Various tech publications emphasize different elements of this incident. Coverage from VideoCardz.com and Neowin points out that the unpatched vulnerabilities were posted accidentally to a public mailing list.


Meanwhile, reporting by Cyber Kendra attributes the disclosure source specifically to Trend Micro ZDI. Phoronix and BigGo Finance note that several Linux kernel vulnerabilities were involved in this public mailing list exposure. The Hacker News frames the incident around the specific severity metrics, identifying the issues as two CVSS 9.0 Linux KSMBD remote code execution flaws disclosed on public mailing lists before kernel fixes. Contextually, the disclosure of high-severity vulnerabilities without prior patching represents a significant security event for administrators relying on the Linux kernel. The coverage does not yet specify the exact mechanics of the accidental email transmission or the precise identity of the individual who posted the details. However, the reports collectively highlight the risks associated with premature public exposure of zero-day or unpatched technical flaws in core operating system components.


Because the mailing lists are publicly accessible, the security details became immediately available to anyone monitoring those channels, bypassing the standard coordinated vulnerability disclosure timeline. As the situation develops, observers and system administrators are monitoring technology news sources for official responses from the Linux kernel development community. Coverage does not yet specify when official patches for the two CVSS 9.0 KSMBD flaws will be released, nor does it detail specific mitigation steps beyond awaiting upstream kernel updates. Further reporting from outlets tracking the Linux kernel and cybersecurity advisories will be necessary to determine the timeframe for remediation and the full scope of affected kernel versions.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| BigGo Finance | Linux Kernel Hit by Two 9.0-Severity SMB Flaws Posted to Public Lists Before Any Fix | [Source Link](https://news.google.com/rss/articles/CBMidkFVX3lxTE5zM3pCUEhkSGRhb0dXSWZMSFlxdEhJdHJxNG1XdzFoaHY0STg4OGtjRXlNQlV2RHVDR2NMVm8taHB1NVRqQVZaOFhoRHpYLS1rT1RPQk5NSTJ5dElMcWhrWUxNbU1QWi1XUU5WY0FnN0pWanZIRWc?oc=5) |
| VideoCardz.com | Someone accidentally posted unpatched Linux kernel vulnerabilities on a public mailing list | [Source Link](https://news.google.com/rss/articles/CBMiuwFBVV95cUxNdk0zZjl3akFBbjNfM3VEekxBR2Q0b0hEY2JHdVh1TXRyTFR1ZmFfM0hWV0drcXFXX0NUdVVpNjVzcFdsa1BrOHF5WkFzMTRqekZVM0p2c3ZVOFQyZzdwWFF3Z0R6QllGNkhPXzNNVm5XR2VXNEZzOW16YUgzUWlWQ2xZRlVUSUlmVHc5Yk5vVEsta1pGLUZZcl92Qmc1c20wY0h0bUlIV3AtSGlDX0NyTU9GQVcyb0xTX0dr?oc=5) |
| Neowin | Unpatched Linux kernel vulnerabilities accidentally emailed to public mailing list | [Source Link](https://news.google.com/rss/articles/CBMisAFBVV95cUxQTVp3NnpKQndwZVhxVGxMdDZnMi1WS0hwZEtrMkx5OUNnNWVmYWtoeWVoWkp3NHlyQjVoVVNDTExZZkVqamhudjJieXJrcDVOdVhvd2NsREJFUmxBYjNpdVFjTHVZN3RKRy15YVRsVDhNYXNuT1N3bDhJQTNKQkpJWXdoR0FXamFoMWQxUmE0alZibEFGTm01SUhySzhGT05vcEVfUS1jY0FsRkxOMzZwZA?oc=5) |
| Cyber Kendra | Linux KSMBD RCE Flaws Disclosed Unpatched by Trend Micro ZDI | [Source Link](https://news.google.com/rss/articles/CBMijwFBVV95cUxOS3hCODJUTEg4LTNKd2d4R1U0MzlueEVXbWd6RDc3THRXT0F0WXZEb2tPWlNJX2RndUVwZDJDZkVJOHJaMGRvUzJhX0lYMFZkU2xCVU1hLTdyUzFtSjhNc2VUeGhPdThsUzNQaGNENUszVF9rZC1MSGtpRW5pOGxnYUFhc2RaQVYya3FSenBoYw?oc=5) |
| Phoronix | Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List | [Source Link](https://news.google.com/rss/articles/CBMibEFVX3lxTFBaWUFmVy1KRFZnMy1vU05tRDJWelU4S2RjUWdTUGY4Nmx0WTRBQjl4OHFPcFdMbG0zZU01eGtRWDRlQjdxQmI1RlFMOGltWG9oczJIM1ZXLXFOOXBkZWxMT2FtX1cxd0djdktZcw?oc=5) |
| The Hacker News | Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes | [Source Link](https://news.google.com/rss/articles/CBMifEFVX3lxTE9xRnZSdjlzYld3MW1iXy1UN1ZxRmppRVNnM1lUaGNZMnVDUkFiQVZFNXZwb2xoeW9uYXhiazlmeDhmNHR0Y1FLenVQV0gtOUIzTzN4bklwcUptRUliSjU2cEZscklObDR0M3JMaWlNaklEcW1CY2ZYdWtOc1o?oc=5) |

---
*Canonical Source: https://pulse.byoaiapps.com/trend/2026-10-23/two-cvss-9-0-linux-ksmbd-rce-flaws-disclosed-on-public-mailing-lists-before*