CVE-2012-6536: net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not verify that the actual Netlink message length...

Security readout for executives and security teams

This is an old Linux kernel information disclosure flaw. On kernels before 3.6, a local user or process with CAP_NET_ADMIN could trigger malformed XFRM Netlink state handling and read sensitive data from kernel heap memory. The provided sources support local exposure, not remote compromise. Exposure is most likely on legacy Linux systems running kernels before 3.6 where untrusted local users, containers, or services can obtain CAP_NET_ADMIN. Modern vendor-supported kernels are less likely to be affected, but backport status must be checked per distribution. Treat this as a legacy hardening issue unless unsupported kernels or broad CAP_NET_ADMIN use exist. Prioritize remediation on shared hosts, container platforms, and systems handling secrets. No provided source supports active exploitation or remote attack. Mitigation focus: Upgrade to a vendor-supported kernel containing the upstream XFRM length validation fix.; Check distribution advisories for backported fixes rather than relying only on version strings.; Restrict CAP_NET_ADMIN to trusted users, services, and containers..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.