You're not necessarily wrong, although simply saying "Linux" isn't accurate either because it's in part a vuln exposed by a specific kconfig, which differs by d

You're not necessarily wrong, although simply saying "Linux" isn't accurate either because it's in part a vuln exposed by a specific kconfig, which differs by distro. From the caveats section: > The exploit does not work v6.4> kernels with kconfig CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y (including Ubuntu v6.5) > The exploits requires user namespaces (kconfig CONFIG_USER_NS=y), that those user namespaces are unprivileged (sh command sysctl kernel.unprivileged_userns_clone = 1), and that nf_tables is enabled (kconfig CONFIG_NF_TABLES=y). By default, these are all enabled on Debian, Ubuntu, and KernelCTF. Other distro's have not been tested, but may work as well. Also with other distros like Fedora and Arch, the kernel versions change frequently including new big versions (like 6.4 to 6.5, what in semver would be called "minor" but isn't super accurate for the linux kernel) so that list would be outdated very quickly if not immediately (for example my Fedora machine right now is on kernel 6.7.9, way beyond what is vulnerable). It's quite possible that Ubuntu is the only vulnerable distro given the way they manage kernel versions. That's not a criticism of Ubuntu, because there are pros and cons of each approach, but in this case it does probably make Ubuntu more vulnerable. RHEL and derivatives also tend to stick on a version long term, and it looks like RHEL 9.3 is on kernel 5.14 so could be vulnerable but it's at the very beginning of the range. That would be a useful thing to know. I think it's also (generally) far more useful for most people to hear a descriptor that most closely aligns with something they can readily identify whether it affects them or not. Then people can look at the details themselves. Edit: added a little more on other distros like Fedora and Arch