Oct 21, 2026: ZDI accidentally Cc’d public lists with unpatched reports including ksmbd CVSS 9.0 RCE (ZDI-CAN-33774, ZDI-CAN-33549). Fix 68f410faedaf in maintainer tree not in mainline as of Oct 22. Only hosts running in-kernel ksmbd exposed; Samba-only servers not affected.