CVE-2009-0031

Severity: medium (CVSS 4.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-01-21 · updated 2026-06-16
Weakness: CWE-399

Description

Memory leak in the keyctl_join_session_keyring function (security/keys/keyctl.c) in Linux kernel 2.6.29-rc2 and earlier allows local users to cause a denial of service (kernel memory consumption) via unknown vectors related to a "missing kfree."

Affected products

Linux kernel: through 2.6.28.1; 2.2.27, 2.4.36, 2.4.36.1, 2.4.36.2, 2.4.36.3, 2.4.36.4 (+91)

References

http://git2.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0d54ee1c7850a954026deec4cd4885f331da35cc
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00003.html
http://osvdb.org/51501
http://rhn.redhat.com/errata/RHSA-2009-0264.html
http://secunia.com/advisories/33858
http://secunia.com/advisories/34252
http://secunia.com/advisories/34394
http://secunia.com/advisories/34502
http://secunia.com/advisories/34762
http://secunia.com/advisories/34981
http://secunia.com/advisories/35011
http://support.avaya.com/elmodocs2/security/ASA-2009-114.htm

Get alerted when CVE-2009-0031 or the next vulnerability affects your stack