CVE-2013-2636: net/bridge/br_mdb.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows l...

Security readout for executives and security teams

This is an old Linux kernel information disclosure bug. A local user could trigger bridge-related kernel code and receive unintended kernel memory contents. It is not described as remote code execution, but leaked kernel memory can weaken system isolation and aid further attacks. Exposure is most likely on systems running Linux kernel versions before 3.8.4 or vendor kernels missing the backported fix. The source data indicates local-user access is required. Distribution-specific affected package ranges are not provided in the bundle. Treat this as a moderate legacy kernel exposure. It needs remediation where old kernels remain, especially shared systems, but the sources do not support emergency handling for remote or actively exploited attacks. Mitigation focus: Upgrade to Linux kernel 3.8.4 or a vendor-supported kernel containing the upstream fix.; Check distribution advisories for backported fixes rather than relying only on upstream version numbers.; Prioritize shared, multi-user, and untrusted workload hosts for remediation..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.