CVE-2009-2692
HIGH EXPLOITEDLinux kernel <2.6.30.4, <2.4.37.4 - Privilege Escalation
Title source: llmDescription
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.
Exploits (10)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubylocallinux
https://www.exploit-db.com/exploits/19933
exploitdb
WORKING POC
VERIFIED
by Ramon de C Valle · textlocallinux
https://www.exploit-db.com/exploits/9641
exploitdb
WORKING POC
VERIFIED
by Ramon de C Valle · textlocallinux
https://www.exploit-db.com/exploits/9598
exploitdb
WORKING POC
VERIFIED
by Ramon de C Valle · clocallinux
https://www.exploit-db.com/exploits/9545
exploitdb
WORKING POC
VERIFIED
by INetCop Security · clocallinux
https://www.exploit-db.com/exploits/9479
exploitdb
WORKING POC
VERIFIED
by Przemyslaw Frasunek · textlocallinux
https://www.exploit-db.com/exploits/9436
metasploit
WORKING POC
GREAT
by Tavis Ormandy, Julien Tinnes <julien at cr0.org>, spender, rcvalle, egypt · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/sock_sendpage.rb
References (39)
... and 19 more
Scores
CVSS v3
7.8
EPSS
0.1756
EPSS Percentile
95.1%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
VulnCheck KEV
2026-02-09
CWE
CWE-908
Status
published
Products (12)
debian/debian_linux
4.0
linux/linux_kernel
2.4.4 - 2.4.37.5
redhat/enterprise_linux_desktop
4.0
redhat/enterprise_linux_desktop
5.0
redhat/enterprise_linux_eus
4.8
redhat/enterprise_linux_eus
5.3
redhat/enterprise_linux_server
4.0
redhat/enterprise_linux_server
5.0
redhat/enterprise_linux_server_aus
5.3
redhat/enterprise_linux_workstation
4.0
... and 2 more
Published
Aug 14, 2009
Tracked Since
Feb 18, 2026