Re: ZDI-CAN-33367: New Vulnerability Report

[Willy Tarreau]

On Thu, Oct 22, 2026 at 11:28:49AM -0400, Willem de Bruijn wrote:
> Eric Dumazet wrote:
> > Le mer. 21 oct. 2026 à 23:47, zdi-disclosures@xxxxxxxxxxxxxx
> > <zdi-disclosures@xxxxxxxxxxxxxx> a écrit :
> > >
> > > ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege Escalation Vulnerability
> > >
> > > -- CVSS -----------------------------------------
> > >
> > > 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
> > >
> > > -- ABSTRACT -------------------------------------
> > >
> > > Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products:
> > > Linux - Kernel
> > >
> > > -- VULNERABILITY DETAILS ------------------------
> > > * Version Tested:7.3-rc1
> > > * Platform Tested:debian trixie
> > >
> > 
> > I had to cut this report. Way too long, I could not see a patch in it.
> 
> Right. For future reports: please review the documentation on how to
> share such findings:
> 
> https://docs.kernel.org/process/security-bugs.html

Rest assured that we've been asking for this many times. The situation
has improved a bit, now we no longer receive the report in a password
protected Zip file and maintainers are finally in Cc. But it looks like
having a direct communication channel with the initial reporter to be
able to discuss and test a patch remains way too far stretched for now.

Despite their sincere efforts, I personally think that the ZDI reports
remain by far the worst we're seeing in terms of efficiency, and among
those which generate the most round trips.

Fortunately most reports these days likely come from AI tools so they
also come in parallel from other channels where communication is
direct. Maybe one day this will further improve, I don't know.

Willy