diff --git a/volatility/plugins/overlays/linux/linux.py b/volatility/plugins/overlays/linux/linux.py index d0df4ecc3..b1d1d87bf 100644 --- a/volatility/plugins/overlays/linux/linux.py +++ b/volatility/plugins/overlays/linux/linux.py @@ -2364,7 +2364,14 @@ def generate_suggestions(self): comm_offset = profile.get_obj_offset("task_struct", "comm") pid_offset = profile.get_obj_offset("task_struct", "pid") - state_offset = profile.get_obj_offset("task_struct", "state") + + try: + # For Linux kernels < v5.14-rc1 + state_offset = profile.get_obj_offset("task_struct", "state") + except KeyError: + # For Linux kernels >= v5.14-rc1, based on commit 2f064a59a11ff9bc22e52e9678bc601404c7cb34 + state_offset = profile.get_obj_offset("task_struct", "__state") + files_offset = profile.get_obj_offset("task_struct", "files") mm_offset = profile.get_obj_offset("task_struct", "active_mm")