CVE-2013-3223: The ax25_recvmsg function in net/ax25/af_ax25.c in the Linux kernel before 3.9-rc7 does not initialize a ce...

Security readout for executives and security teams

CVE-2013-3223 is a Linux kernel information leak in the AX.25 networking code. A local user could cause the kernel to return uninitialized stack memory. That may expose sensitive kernel data and help another attack, but the provided sources do not show remote exploitation or active exploitation. Exposure is most likely on old Linux systems running kernels before 3.9-rc7 or unpatched vendor kernels with AX.25 support available to local users. The bundle does not identify specific affected distribution package versions. Treat this as a legacy Linux kernel hygiene issue. Prioritize internet-facing shared servers, multi-user systems, and unsupported appliances first. It is not supported as an emergency active-exploitation item by the provided evidence. Mitigation focus: Apply vendor kernel updates from the relevant distribution advisory.; Upgrade to a kernel containing upstream commit ef3313e84acbf349caecae942ab3ab731471f1a1.; Reboot systems after kernel updates so the fixed kernel is active..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.