Description
This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the nft_osf_eval function. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-18540.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Kernel | 6.0-rc2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.0.2-1 | — |
| Debian 13 | linux | 6.0.2-1 | — |
| Debian 12 | linux | 6.0.2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-57.63 | — |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1027.31 | — |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1030.37 | — |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1030.37.1 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1026.33 | — |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1024.29 | — |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1012.16 | — |
| Ubuntu 22.04 LTS | linux-ibm | 5.15.0-1022.25 | — |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1023.28 | — |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1025.30 | — |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1015.15 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1026.32 | — |
| Ubuntu 22.04 LTS | linux-raspi | 5.15.0-1022.24 | — |
| Ubuntu 22.04 LTS | linux-riscv +3 | No fix yet | — |
| Ubuntu 20.04 LTS | linux | 5.4.0-136.153 | — |
| Ubuntu 20.04 LTS | linux-aws | 5.4.0-1093.101 | — |
| Ubuntu 20.04 LTS | linux-aws-5.15 +1 | 5.15.0-1027.31~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-azure | 5.4.0-1100.106 | — |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1030.37~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-bluefield | 5.4.0-1054.60 | — |
| Ubuntu 20.04 LTS | linux-gcp | 5.4.0-1097.106 | — |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1027.34~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gke | 5.4.0-1091.98 | — |
| Ubuntu 20.04 LTS | linux-gke-5.15 | 5.15.0-1027.32~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gkeop | 5.4.0-1061.65 | — |
| Ubuntu 20.04 LTS | linux-gkeop-5.15 | 5.15.0-1012.16~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-hwe-5.15 | 5.15.0-57.63~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-ibm | 5.4.0-1041.46 | — |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1023.28~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-iot | 5.4.0-1010.12 | — |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1083.89 | — |
| Ubuntu 20.04 LTS | linux-lowlatency-hwe-5.15 | 5.15.0-58.64~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1091.100 | — |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1027.33~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1078.89 | — |
| Ubuntu 20.04 LTS | linux-riscv +23 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-aws-5.4 | 5.4.0-1093.102~18.04.2 | — |
| Ubuntu 18.04 LTS | linux-azure-5.4 | 5.4.0-1100.106~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp-5.4 | 5.4.0-1097.106~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-hwe-5.4 | 5.4.0-136.153~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-ibm-5.4 | 5.4.0-1041.46~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-oracle-5.4 | 5.4.0-1091.100~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-raspi-5.4 | 5.4.0-1078.89~18.04.1 | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1029.32 | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1093.101+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1100.106+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1069.78 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1097.106+fips1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | kernel-rt +12 | 5.14.0-162.6.1.rt21.168.el9_1 | RHSA-2022:7933 |
| RHEL 9 | perf +29 | 5.14.0-162.6.1.el9_1 | RHSA-2022:8267 |
Advisories 6
- RHSA-2022:8267 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2022:7933 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SSA-794697 SSA-794697: Vulnerabilities in the Additional GNU/Linux Subsystem of the SIMATIC S7-1500 TM MFP Before V1.1 Siemens ProductCERT · Oct 13, 2026
- ICSA-23-166-11 Siemens SIMATIC S7-1500 TM MFP Linux Kernel CISA ICS & IT advisories · Apr 9, 2024
- WID-SEC-2022-1819 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 28, 2023
- WID-SEC-2023-1432 Siemens SIMATIC S7: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 22, 2023