RE: ZDI-CAN-33367: New Vulnerability Report

["zdi-disclosures@trendmicro.com" <zdi-disclosures@trendmicro.com>]

On Thu, Oct 22, 2026 at 11:28:49AM -0400, Willem de Bruijn wrote:
> Eric Dumazet wrote:
> > Le mer. 21 oct. 2026 à 23:47, zdi-disclosures@trendmicro.com
> > <zdi-disclosures@trendmicro.com> a écrit :
> > >
> > > ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege Escalation Vulnerability
> > >
> > > -- CVSS -----------------------------------------
> > >
> > > 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
> > >
> > > -- ABSTRACT -------------------------------------
> > >
> > > Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products:
> > > Linux - Kernel
> > >
> > > -- VULNERABILITY DETAILS ------------------------
> > > * Version Tested:7.3-rc1
> > > * Platform Tested:debian trixie
> > >
> >
> > I had to cut this report. Way too long, I could not see a patch in it.
>
> Right. For future reports: please review the documentation on how to
> share such findings:
>
> https://docs.kernel.org/process/security-bugs.html

We've probably submitted nearly 1000 cases to kernel over the last ten years.

How those cases are formatted today is essentially the same as the way they were
formatted 10+ years ago aside from the changes you asked for in the past, but
for the most part you've never had a problem with the way they were formatted until recently.

I may be mistaken here, but I searched our mailbox and this is the first time
I'm seeing the references to documentation on submitting findings to you.

We will have some discussions internally, but in the meantime, we will send the cases to you as we always have.
If you don't want to do anything with it, that's fine too. We will release the findings at rejection, or 120 days.
Whichever comes first.

Weird that Red Hat is on this email... Greg once told me he had no idea who those people
were and asked that they be removed from security reports. I will probably get in touch with
them again to discuss reporting.

We understand that your workflow has increased because of AI... and we are in the same boat.
The snide remarks and hostilities aren't new from your side, but we are doing our best with the people we have.

I get the feeling that even if we were to update our report formatting to match your documentation
It still wouldn't be enough because we aren't going to provide you with patches. That's just the way it is.
It's not my call, and it's overhead we cannot support. In the same token, I know that you rely on a lot of contributors
to get these bugs fixed... that's not lost on us.

We do know that you'd rather us not send you anything at all in that case,
which is why we will more than likely have to entertain other options.


>These ZDI monkeys are clue resistent. We've pointed them at this file a
>gazillion of times; they do whatever they want and ignore all feedback.



I would like to say that resorting to racially insensitive pejoratives is quite unbecoming, and you should be more mindful of who you're calling "monkeys".

That may be okay where you're from, but there is no excuse to speak to people this way, and there is no justification in doing so.  Even if you don't like our reports.

-The ZDI


TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
For details about what personal information we collect and why, please see our Privacy Notice on our website at: [ https://www.trendmicro.com/privacy]