CVE-2009-2692

HIGH EXPLOITED

Linux kernel <2.6.30.4, <2.4.37.4 - Privilege Escalation

Title source: llm

Description

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.

Exploits (10)

exploitdb WORKING POC VERIFIED
by Metasploit · rubylocallinux
https://www.exploit-db.com/exploits/19933
exploitdb WORKING POC VERIFIED
by Ramon de C Valle · textlocallinux
https://www.exploit-db.com/exploits/9641
exploitdb WORKING POC VERIFIED
by Ramon de C Valle · textlocallinux
https://www.exploit-db.com/exploits/9598
exploitdb WORKING POC VERIFIED
by Ramon de C Valle · clocallinux
https://www.exploit-db.com/exploits/9545
exploitdb WORKING POC VERIFIED
by INetCop Security · clocallinux
https://www.exploit-db.com/exploits/9479
exploitdb WORKING POC VERIFIED
by Zinx · textlocalandroid
https://www.exploit-db.com/exploits/9477
exploitdb WORKING POC VERIFIED
by Przemyslaw Frasunek · textlocallinux
https://www.exploit-db.com/exploits/9436
exploitdb WRITEUP VERIFIED
by spender · textlocallinux
https://www.exploit-db.com/exploits/9435
nomisec WORKING POC
by jdvalentini · poc
https://github.com/jdvalentini/CVE-2009-2692
metasploit WORKING POC GREAT
by Tavis Ormandy, Julien Tinnes <julien at cr0.org>, spender, rcvalle, egypt · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/sock_sendpage.rb

References (39)

... and 19 more

Scores

CVSS v3 7.8
EPSS 0.1756
EPSS Percentile 95.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2026-02-09
CWE
CWE-908
Status published
Products (12)
debian/debian_linux 4.0
linux/linux_kernel 2.4.4 - 2.4.37.5
redhat/enterprise_linux_desktop 4.0
redhat/enterprise_linux_desktop 5.0
redhat/enterprise_linux_eus 4.8
redhat/enterprise_linux_eus 5.3
redhat/enterprise_linux_server 4.0
redhat/enterprise_linux_server 5.0
redhat/enterprise_linux_server_aus 5.3
redhat/enterprise_linux_workstation 4.0
... and 2 more
Published Aug 14, 2009
Tracked Since Feb 18, 2026