On October 22, 2026, Trend Micro's Zero Day Initiative (ZDI) team mistakenly forwarded multiple vulnerability reports concerning the Linux kernel to the public Linux Kernel Mailing List (LKML). Among these were two remote code execution vulnerabilities, each boasting a CVSS score as high as 9.0. These vulnerabilities impact various subsystems, including network communication, file sharing, virtualized graphics drivers, and storage services. Notably, some of these vulnerabilities have yet to be patched. Email header details suggest that the reports were erroneously included in the public list when intended for the kernel security team. The precise reason for this misdirected email remains uncertain at present.
