CVE-2009-1961: canonical ubuntu_linux Improper Locking
Vulnerability summary
CVE-2009-1961 is a medium (CVSS 4.7) Improper Locking vulnerability in canonical ubuntu_linux. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 48.2% of scored vulnerabilities. 5 public exploits are recorded.
Not severe (CVSS 4.7, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2Timeline
- 06-06-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creation and removal) via a series of splice system calls that trigger a deadlock between the generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write functions.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.59%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.59% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
5 foundExploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (securityfocus.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse3 products
Canonical1 product
- ubuntu_linuxEOL6.06 | 8.04 | 8.10 | 9.04
Debian1 product
- debian_linuxEOL4.0
Linux1 product
- linux_kernel≤ 2.6.19 | ≥ 2.6.27, < 2.6.27.24 | ≥ 2.6.29, < 2.6.29.4 | 2.6.30:rc1 | 2.6.30:rc2
Opensuse1 product
- opensuseEOL10.3 | 11.1
5 vendors · 7 products
References
20 links- www.mandriva.com/security/advisories?name=MDVSA-2009:135Vendor AdvisoryX Refsource MANDRIVABroken Link
- www.mandriva.com/security/advisories?name=MDVSA-2009:148Vendor AdvisoryX Refsource MANDRIVABroken Link
- lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing List
Show all 20 references
- lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.htmlVendor AdvisoryX Refsource SUSEMailing List
- lists.opensuse.org/opensuse-security-announce/2009-07/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing List