Quick answer

In “System Information”, LinPEAS reports the kernel version, loaded modules and protections (AppArmor/SELinux, etc.), and checks the kernel against a bundled exploit registry (linux-exploit-suggester is embedded). Version-based matches are leads, not proof — backported patches often make them false positives.

Where it appears#

Kernel checks are in the System Information section (system_information). With -V or -a, LinPEAS can also send a package/kernel inventory to an online service for vulnerability lookup (an outbound request — see is LinPEAS safe?).

Kernel version ≠ patch level

Enterprise distributions backport fixes without bumping the version string, so a version-based kernel-exploit flag can be a false positive. Confirm the actual patch level (e.g. distro changelog) before trusting it.

Verify it yourself#

Reproduce the kernel checks
uname -a
cat /proc/version
lsmod | head

Sources & references

  1. linPEAS README
  2. PEASS-ng release — reviewed 20260908-dffb9496
  3. HackTricks: Linux privilege escalation