Re: ZDI-CAN-33367: New Vulnerability Report

[Peter Zijlstra]

On Thu, Oct 22, 2026 at 11:28:49AM -0400, Willem de Bruijn wrote:
> Eric Dumazet wrote:
> > Le mer. 21 oct. 2026 à 23:47, zdi-disclosures@xxxxxxxxxxxxxx
> > <zdi-disclosures@xxxxxxxxxxxxxx> a écrit :
> > >
> > > ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege Escalation Vulnerability
> > >
> > > -- CVSS -----------------------------------------
> > >
> > > 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
> > >
> > > -- ABSTRACT -------------------------------------
> > >
> > > Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products:
> > > Linux - Kernel
> > >
> > > -- VULNERABILITY DETAILS ------------------------
> > > * Version Tested:7.3-rc1
> > > * Platform Tested:debian trixie
> > >
> > 
> > I had to cut this report. Way too long, I could not see a patch in it.
> 
> Right. For future reports: please review the documentation on how to
> share such findings:
> 
> https://docs.kernel.org/process/security-bugs.html

These ZDI monkeys are clue resistent. We've pointed them at this file a
gazillion of times; they do whatever they want and ignore all feedback.