CVE-2012-6537: net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not initialize certain structures, which allows lo...

Security readout for executives and security teams

CVE-2012-6537 is a Linux kernel information disclosure issue. A local user with CAP_NET_ADMIN could cause certain XFRM networking structures to expose uninitialized kernel memory. This is not described as remote code execution, and the provided sources do not show active exploitation. Exposure is most likely on legacy Linux systems running kernels before 3.6 or vendor kernels missing the relevant backport. Risk increases where untrusted users, services, or containers can obtain CAP_NET_ADMIN. Treat this as a legacy Linux hygiene issue with higher priority in multi-tenant or containerized environments. It is unlikely to be an emergency from the provided evidence, but exposed old kernels and broad CAP_NET_ADMIN use deserve prompt remediation. Mitigation focus: Apply vendor kernel updates that include the XFRM initialization fixes.; Reboot systems so the patched kernel is actually running.; Restrict CAP_NET_ADMIN to trusted users, services, and containers..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.