Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Udev Project

First CVE: Apr 17, 2009Active for: 17 yearsTotal CVEs: 4

Udev is the Linux device manager responsible for dynamic device-file creation and permission management in the kernel interface, and its vulnerabilities center on low-level input handling and access-control configuration affecting system initialization and device access. The observed weakness classes include buffer overflows, incorrect default permissions, and origin validation errors, reflecting the challenges of parsing and authorizing diverse hardware interfaces at the point of device discovery. Current exploitation activity, severity breakdown, and exposure counts are shown alongside this summary.

FAUCET AI Generated
4
Total CVEs
More Total CVEs than 79% of tracked vendors
1.3
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 75% of tracked vendors
5.0
Avg CVSS Score
Higher Avg CVSS Score than 13% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Udev Project over time

Volume of CVEsAvg CVSS Base Score
First CVE
Apr 17, 2009
17 years ago
Most Recent CVE
Jan 25, 2011
5,659 days ago

Products(1 total)

Top CVEs

Signals from CVEs in this vendor scope (4 CVEs).

4 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2009-1185HIGH
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.
Apr 17, 20097.284NOYES
CVE-2011-0640MEDIUM
The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attacke
Jan 25, 20116.923NONO
CVE-2010-4176MEDIUM
plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read
Dec 7, 20104.017NONO
CVE-2009-1186LOW
Buffer overflow in the util_path_encode function in udev/lib/libudev-util.c in udev before 1.4.1 allows local users to cause a denial of service (service outage) via vectors that t
Apr 17, 20092.113NONO
View all 4 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products4 CVEs
25%
50%
25%
Severity distribution among all CVEs352,294 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local0 (0.0%)
Network0 (0.0%)
Unknown4 (100.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low0 (0.0%)
High0 (0.0%)
Unknown4 (100.0%)
User Interaction
None0 (0.0%)
Unknown4 (100.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None0 (0.0%)
Unknown4 (100.0%)

Exploit Exposure

Signals from CVEs in this vendor scope (4 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
1 CVE
25.0% of CVEs· 99th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
25.0% of CVEs· 78th percentile

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Udev Project.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Udev Project — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Udev Project's Products

View all 2 CNAs →

Top CWEs