Skip to content
Fencer Vulns
high 7.2

CVE-2009-2695 json

The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which al…

published 2009-08-28 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-2687

cvss
7.2
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.

Patch / fix

  • kernel RHEL 5 2.6.18-164.6.1.el5
  • kernel-PAE RHEL 5 2.6.18-164.6.1.el5
  • kernel-xen RHEL 5 2.6.18-164.6.1.el5
  • kernel-kdump RHEL 5 2.6.18-164.6.1.el5
  • kernel-debuginfo-common RHEL 5 2.6.18-164.6.1.el5
  • kernel-rt enterprise mrg 1 2.6.24.7-137.el5rt
  • kernel-rt-trace enterprise mrg 1 2.6.24.7-137.el5rt
  • kernel-rt-vanilla enterprise mrg 1 2.6.24.7-137.el5rt

red hat advisories RHSA-2009:1548RHSA-2009:1587RHSA-2009:1672RHSA-2009:1540

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2009-2695 updated cvss 2.1

kernel: SELinux and mmap_min_addr

  • Red Hat MRG Realtime for RHEL 5 Server kernel-rt 2.6.24.7-137.el5rt, kernel-rt-trace 2.6.24.7-137.el5rt, kernel-rt-vanilla 2.6.24.7-137.el5rt, kernel-rt-debuginfo-common 2.6.24.7-137.el5rt
    fixed: vendor fix RHSA-2009:1540
  • Red Hat Enterprise Linux (v. 5 server) kernel 2.6.18-164.6.1.el5, kernel-PAE 2.6.18-164.6.1.el5, kernel-xen 2.6.18-164.6.1.el5, kernel-kdump 2.6.18-164.6.1.el5, kernel-debuginfo-common 2.6.18-164.6.1.el5 Red Hat Enterprise Linux Desktop (v. 5 client) kernel 2.6.18-164.6.1.el5, kernel-PAE 2.6.18-164.6.1.el5, kernel-xen 2.6.18-164.6.1.el5, kernel-kdump 2.6.18-164.6.1.el5, kernel-debuginfo-common 2.6.18-164.6.1.el5
    fixed: vendor fix RHSA-2009:1548
  • Red Hat Enterprise Linux EUS (v. 5.2 server) kernel 2.6.18-92.1.32.el5, kernel-PAE 2.6.18-92.1.32.el5, kernel-xen 2.6.18-92.1.32.el5, kernel-kdump 2.6.18-92.1.32.el5, kernel-debuginfo-common 2.6.18-92.1.32.el5
    fixed: vendor fix RHSA-2009:1672
  • Red Hat Enterprise Linux EUS (v. 5.3 server) kernel 2.6.18-128.11.1.el5, kernel-PAE 2.6.18-128.11.1.el5, kernel-xen 2.6.18-128.11.1.el5, kernel-kdump 2.6.18-128.11.1.el5, kernel-debuginfo-common 2.6.18-128.11.1.el5
    fixed: vendor fix RHSA-2009:1587

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.