Yes, NixOS has already patched this.

NixOS also makes it much easier than ubuntu to install your own patches and version of the linux kernel.

For example, assuming NixOS had not yet released the fixed linux version, 6.18.56 (though it has), you could upgrade to it before NixOS did it upstream with this one line:

    boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.linux_6_18.override {argsOverride = {src = pkgs.fetchurl {url = "mirror://kernel/linux/kernel/v6.x/linux-6.18.56.tar.xz"; }; version = "6.18.56"; modDirVersion = "6.18.56";};});

You could add the patch yourself if you needed to with:

    boot.kernelPatches = [{ patch = ./cve-patch.patch; }];

And then you'd be updated.

The debian and redhat based distros all make it so configuring what packages are installed ('apt install' / 'yum install') is a different operation from configuring the packages themselves.

On NixOS, the specification of how to build a package, what package is installed, patches, etc are all in the same language, and so it's a lot more natural to patch things as needed.

And also, LLMs are pretty good at generating working nix, so you can have an agent apply patches to your kernel package with NixOS quite easily. Agents can also do this for ubuntu or redhat, but in my experience they're much worse at it, and it's harder to undo mistakes if they mess up.