CVE-2009-2695
The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page...
7.2 High
The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.
Exploit likelihood
0.51%Down 1.0 points since Feb 4, 2022
What each source reports
NVD Score used
The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.
- Record
CVE-2009-2695- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.
- Record
CVE-2009-2695- Updated
- 2026-11-02
EUVDEUVD-2009-2687 No score
The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.
- Record
EUVD-2009-2687- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jh8r-4ff3-92j9 No score
The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page...
The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.
- Record
GHSA-jh8r-4ff3-92j9- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVBELL-CVE-2009-2695
CVE-2009-2695 does not affect BellSoft software
- Record
BELL-CVE-2009-2695- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
linux-2.6Debian:5.0 From an advisory covering 10 CVEs |
before 2.6.26-19lenny1, plus listed versions 2.6.26-132.6.26-13lenny22.6.26-13lenny2~bpo40+12.6.26-142.6.26-15 Show 14 moreShow less2.6.26-15lenny12.6.26-15lenny22.6.26-15lenny32.6.26-15~bpo40+12.6.26-15~bpo40+22.6.26-162.6.26-172.6.26-17lenny12.6.26-17lenny22.6.26-17lenny2~bpo40+12.6.26-17~bpo40+12.6.26-182.6.26-192.6.26-19~bpo40+1 |
2.6.26-19lenny1 |
linux-2.6.24Debian:4.0 From an advisory covering 18 CVEs |
before 2.6.24-6~etchnhalf.9etch3, plus listed versions 2.6.24-5~etchnhalf.12.6.24-6~etchnhalf.12.6.24-6~etchnhalf.22.6.24-6~etchnhalf.32.6.24-6~etchnhalf.4 Show 10 moreShow less2.6.24-6~etchnhalf.52.6.24-6~etchnhalf.62.6.24-6~etchnhalf.72.6.24-6~etchnhalf.82.6.24-6~etchnhalf.8etch12.6.24-6~etchnhalf.8etch22.6.24-6~etchnhalf.8etch32.6.24-6~etchnhalf.92.6.24-6~etchnhalf.9etch12.6.24-6~etchnhalf.9etch2 |
2.6.24-6~etchnhalf.9etch3 |
kernel-rtRed Hat:enterprise_mrg:1::el5 From an advisory covering 12 CVEs |
before 0:2.6.24.7-137.el5rt | 0:2.6.24.7-137.el5rt |
kernel-rt-debugRed Hat:enterprise_mrg:1::el5 From an advisory covering 12 CVEs |
before 0:2.6.24.7-137.el5rt | 0:2.6.24.7-137.el5rt |
kernel-rt-debug-debuginfoRed Hat:enterprise_mrg:1::el5 From an advisory covering 12 CVEs |
before 0:2.6.24.7-137.el5rt | 0:2.6.24.7-137.el5rt |
kernel-rt-debug-develRed Hat:enterprise_mrg:1::el5 From an advisory covering 12 CVEs |
before 0:2.6.24.7-137.el5rt | 0:2.6.24.7-137.el5rt |
kernel-rt-debuginfoRed Hat:enterprise_mrg:1::el5 From an advisory covering 12 CVEs |
before 0:2.6.24.7-137.el5rt | 0:2.6.24.7-137.el5rt |
kernel-rt-debuginfo-commonRed Hat:enterprise_mrg:1::el5 From an advisory covering 12 CVEs |
before 0:2.6.24.7-137.el5rt | 0:2.6.24.7-137.el5rt |
kernel-rt-develRed Hat:enterprise_mrg:1::el5 From an advisory covering 12 CVEs |
before 0:2.6.24.7-137.el5rt | 0:2.6.24.7-137.el5rt |
kernel-rt-docRed Hat:enterprise_mrg:1::el5 From an advisory covering 12 CVEs |
before 0:2.6.24.7-137.el5rt | 0:2.6.24.7-137.el5rt |
Show 75 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kernel-rt-traceRed Hat:enterprise_mrg:1::el5 From an advisory covering 12 CVEs |
before 0:2.6.24.7-137.el5rt | 0:2.6.24.7-137.el5rt |
kernel-rt-trace-debuginfoRed Hat:enterprise_mrg:1::el5 From an advisory covering 12 CVEs |
before 0:2.6.24.7-137.el5rt | 0:2.6.24.7-137.el5rt |
kernel-rt-trace-develRed Hat:enterprise_mrg:1::el5 From an advisory covering 12 CVEs |
before 0:2.6.24.7-137.el5rt | 0:2.6.24.7-137.el5rt |
kernel-rt-vanillaRed Hat:enterprise_mrg:1::el5 From an advisory covering 12 CVEs |
before 0:2.6.24.7-137.el5rt | 0:2.6.24.7-137.el5rt |
kernel-rt-vanilla-debuginfoRed Hat:enterprise_mrg:1::el5 From an advisory covering 12 CVEs |
before 0:2.6.24.7-137.el5rt | 0:2.6.24.7-137.el5rt |
kernel-rt-vanilla-develRed Hat:enterprise_mrg:1::el5 From an advisory covering 12 CVEs |
before 0:2.6.24.7-137.el5rt | 0:2.6.24.7-137.el5rt |
kernelRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-PAERed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-PAE-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-PAE-develRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-debugRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-debug-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-debug-develRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-debuginfo-commonRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-develRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-docRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-headersRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-xenRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-xen-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-xen-develRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernelRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-PAERed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-PAE-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-PAE-develRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-debugRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-debug-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-debug-develRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-debuginfo-commonRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-develRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-docRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-headersRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-kdumpRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-kdump-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-kdump-develRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-xenRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-xen-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernel-xen-develRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 0:2.6.18-164.6.1.el5 | 0:2.6.18-164.6.1.el5 |
kernelRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-PAERed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-PAE-debuginfoRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-PAE-develRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-debugRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-debug-debuginfoRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-debug-develRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-debuginfoRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-debuginfo-commonRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-develRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-docRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-headersRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-kdumpRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-kdump-debuginfoRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-kdump-develRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-xenRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-xen-debuginfoRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernel-xen-develRed Hat:rhel_eus:5.3 From an advisory covering 2 CVEs |
before 0:2.6.18-128.11.1.el5 | 0:2.6.18-128.11.1.el5 |
kernelRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-PAERed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-PAE-debuginfoRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-PAE-develRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-debugRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-debug-debuginfoRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-debug-develRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-debuginfoRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-debuginfo-commonRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-develRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-docRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-headersRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-kdumpRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-kdump-debuginfoRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-kdump-develRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-xenRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-xen-debuginfoRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
kernel-xen-develRed Hat:rhel_eus:5.2 From an advisory covering 2 CVEs |
before 0:2.6.18-92.1.32.el5 | 0:2.6.18-92.1.32.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2695 is a high vulnerability (CVSS 7.2) in Linux Kernel, published August 28, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. No source names a fixed version.
References
kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc7
redhat.com/support/errata/RHSA-2009-1672.html
git.kernel.org?p=linux/kernel/git/jmorris/security-testing-2.6.git%3Ba=commit%3Bh=84336d1a77ccd2c06a730ddd38e695c2324a7386
securityfocus.com/bid/36051
rhn.redhat.com/errata/RHSA-2009-1540.html
Show 132 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=517830
ubuntu.com/usn/USN-852-1
secunia.com/advisories/38794
lists.vmware.com/pipermail/security-announce/2010/000082.html
patchwork.kernel.org/patch/36540
kbase.redhat.com/faq/docs/DOC-18042
eparis.livejournal.com/606.html
twitter.com/spendergrsec/statuses/3303390960
thread.gmane.org/gmane.linux.kernel.lsm/9075
danwalsh.livejournal.com/30084.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9882
openwall.com/lists/oss-security/2009/08/17/4
debian.org/security/2010/dsa-2005
vupen.com/english/advisories/2010/0528
nvd.nist.gov/vuln/detail/CVE-2009-2695
github.com/advisories/GHSA-jh8r-4ff3-92j9
docs.bell-sw.com/security/cves/CVE-2009-2695
access.redhat.com/errata/RHSA-2009:1540
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1540.json
cve.org/CVERecord?id=CVE-2009-1895