Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2009-2908

18
FAUCET Score

CVE-2009-2908 describes a denial-of-service vulnerability in the eCryptfs component of the Linux kernel (specifically version 2.6.31). A local attacker can trigger a kernel OOPS and potentially execute arbitrary code by causing a NULL pointer dereference through a "negative dentry." This vulnerability has a CVSS score of 4.9, indicating a low severity, as it requires local access and has a high impact on availability. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
2.6.31CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:2.6.31:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

4.9MEDIUM

AV:L/AC:L/Au:N/C:N/I:N/A:C

Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Exploitability Score
3.9
Impact Score
6.9
CvssVersion
2.0

Exploit Intelligence

EPSS Score
1.24%
Probability of exploitation in next 30 days
EPSS Percentile
66.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0124 is in the 92nd percentile among its peer group of 3,052 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: kernel-0:2.6.18-164.6.1.el5
View patch

Vendor Advisories (1)

redhatCVE-2009-2908Important

kernel ecryptfs NULL pointer dereference

Sep 22, 2009

References

git.kernel.org
lists.vmware.com / pipermail/security-announce/2010/000082.html
bugs.launchpad.net / ecryptfs/+bug/387073
bugzilla.redhat.com / show_bug.cgi
secunia.com / advisories/37075
secunia.com / advisories/37105
secunia.com / advisories/38794
secunia.com / advisories/38834
exchange.xforce.ibmcloud.com / vulnerabilities/53693
oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10216
oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6992
rhn.redhat.com / errata/RHSA-2009-1548.html
redhat.com / archives/fedora-package-announce/2009-October/msg00483.html
openwall.com / lists/oss-security/2009/10/06/1
securityfocus.com / bid/36639
Patch
ubuntu.com / usn/USN-852-1
vupen.com / english/advisories/2010/0528