CVE-2009-3726

Severity: high (CVSS 7.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-11-09 · updated 2026-06-16
Weakness: CWE-399

Description

The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes, which trigger attempted use of an open file that lacks NFSv4 state.

Affected products

Linux kernel: through 2.6.31; 2.2.27, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5 (+383)

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d953126a28f97ec965d23c69fd5795854c048f30
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.html
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html
http://lists.vmware.com/pipermail/security-announce/2010/000082.html
http://secunia.com/advisories/37909
http://secunia.com/advisories/38794
http://secunia.com/advisories/38834
http://secunia.com/advisories/40218
http://www.debian.org/security/2010/dsa-2005
http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.31/ChangeLog-2.6.31-rc4

Get alerted when CVE-2009-3726 or the next vulnerability affects your stack