Retrieve linked servers out of system database files?
The answer placed here for future reference if needed. It looks as though this data may be in a hidden table in the master database sys schema named sysxsrvs.

According to what I could find this may be available to be queried if connected through the DAC.

It also uses sysobjvalues (contained in all databases). I believe to populate the srvproduct/providername fields.

reference: https://msdn.microsoft.com/en-us/library/ms179503.aspx