Multiple unpatched security flaws affecting the Linux kernel were accidentally posted to a public mailing list rather than a private disclosure channel, exposing potential attack vectors before official fixes could reach the main kernel branch. Some of the disclosed issues carry Common Vulnerability Scoring System ratings reaching as high as 9.
The disclosure error, originally reported by Phoronix, involved several vulnerability submissions that appeared to originate from Trend Micro’s Zero Day Initiative. The organization operates a bug bounty network relying on external researchers to discover and disclose security flaws.
Following the public posts, Linux stable branch maintainer Greg Kroah-Hartman replied to each report individually, requesting that the submitters correct their disclosure process. The vulnerabilities currently remain unpatched in the primary kernel release, leaving systems running those builds exposed to known exploits.
Mitigations for several of the reported bugs are already queued or undergoing testing within Linux beta and “-next” development branches. As a result, users running Linux distributions that provide access to beta update channels may be able to obtain early patches before they roll out to standard stable releases.
Source: PC Gamer
