So I understand this means we will need to wait till October 6 for more details. Would it be safe to assume anything being talked about right now is speculation?
But the "(+ others)" seems to imply it's not Linux kernel.
And OpenSSH is maintained by OpenBSD folks, who take security extremely seriously. I cannot imagine them taking 3+ weeks and not having security fix, nor arguing whether "Unauthenticated RCE" has a security impact.
So I am guessing it's one of the other common packages, probably not installed on every computer and/or not normally exposed to the internet.
* Full disclosure happening in less than 2 weeks (as agreed with devs).
* Still no working fix.