CVE-2009-3726: linux linux_kernel Resource Management Errors

Modified

Published 09-11-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-3726 is a high (CVSS 7.8) Resource Management Errors vulnerability in linux linux_kernel. EPSS estimates a 12.00% chance of exploitation in the next 30 days, higher than 96.1% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (exploit-database, 15-10-2009)

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v2.0 (NVD)

EPSS score

12.00%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 5

DSA-2003-1 DSA-2005-1 RHSA-2009:1635 RHSA-2009:1670 RHSA-2010:0474

Timeline

09-11-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes, which trigger attempted use of an open file that lacks NFSv4 state.

CVSS metrics

1 score · 1 source · 1 version

v2.07.8

EPSS trend

Probability

12.00%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 12.00% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

exploit-databasedoslinuxVerified
Linux Kernel < 2.6.31-rc4 - 'nfs4_proc_lock()' Denial of Service
Maturity: poc

Weaknesses

CWE · root cause

CWE-399Resource Management ErrorsWeaknesses in this category are related to improper management of system resources.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Linux1 product

linux_kernel2.6.22.6 | 2.6.22.7 | 2.6.22.8 | 2.6.22.9 | 2.6.22.10 | 2.6.22.11 | 2.6.22.12 | 2.6.22.13 | 2.6.22.14 | 2.6.22.15 | 2.6.22.16 | 2.6.22.17 | 2.6.22.18 | 2.6.22.19 | 2.6.22.20 | 2.6.22.21 | 2.6.22.22 | 2.6.22_rc1 | 2.6.22_rc7 | 2.6.23 | 2.6.23:rc1 | 2.6.23:rc2 | 2.6.23.1 | 2.6.23.2 | 2.6.23.3 | 2.6.23.4 | 2.6.23.5 | 2.6.23.6 | 2.6.23.7 | 2.6.23.8 | 2.6.23.9 | 2.6.23.10 | 2.6.23.11 | 2.6.23.12 | 2.6.23.13 | 2.6.23.14 | 2.6.23.15 | 2.6.23.16 | 2.6.23.17 | 2.6.24 | 2.6.24:rc1 | 2.6.24:rc2 | 2.6.24:rc3 | 2.6.24:rc4 | 2.6.24:rc5 | 2.6.24.1 | 2.6.24.2 | 2.6.24.3 | 2.6.24.4 | 2.6.24.5 | 2.6.24.6 | 2.6.24.7 | 2.6.25 | 2.6.25.1 | 2.6.25.2 | 2.6.25.3 | 2.6.25.4 | 2.6.25.5 | 2.6.25.6 | 2.6.25.7 | 2.6.25.8 | 2.6.25.9 | 2.6.25.10 | 2.6.25.11 | 2.6.25.12 | 2.6.25.13 | 2.6.25.14 | 2.6.25.15 | 2.6.25.16 | 2.6.25.17 | 2.6.25.18 | 2.6.25.19 | 2.6.25.20 | 2.6.26 | 2.6.26:rc4 | 2.6.26.1 | 2.6.26.2 | 2.6.26.3 | 2.6.26.4 | 2.6.26.5 | 2.6.26.6 | 2.6.26.7 | 2.6.26.8 | 2.6.27 | 2.6.27:rc1 | 2.6.27:rc2 | 2.6.27:rc3 | 2.6.27:rc4 | 2.6.27:rc5 | 2.6.27:rc6 | 2.6.27:rc7 | 2.6.27:rc8 | 2.6.27:rc9 | 2.6.27.1 | 2.6.27.2 | 2.6.27.3 | 2.6.27.4 | 2.6.27.5 | 2.6.27.6 | 2.6.27.7 | 2.6.27.8 | 2.6.27.9 | 2.6.27.10 | 2.6.27.11 | 2.6.27.12 | 2.6.28 | 2.6.28:rc1 | 2.6.28:rc2 | 2.6.28:rc3 | 2.6.28:rc4 | 2.6.28:rc5 | 2.6.28:rc6 | 2.6.28:rc7 | 2.6.28.1 | 2.6.28.2 | 2.6.28.3 | 2.6.28.4 | 2.6.28.5 | 2.6.28.6 | 2.6.28.7 | 2.6.28.8 | 2.6.28.9 | 2.6.29 | 2.6.29:git1 | 2.6.29:rc1 | 2.6.29:rc2 | 2.6.29:rc2_git7 | 2.6.29:rc8-kk | 2.6.29.3 | 2.6.29.5 | 2.6.30 | 2.6.30:rc1 | 2.6.30:rc2 | 2.6.30:rc3 | 2.6.30:rc5 | 2.6.30:rc6 | 2.6.30:rc7-git6 | 2.6.31:rc1 | 2.6.31:rc2 | ≤ 2.6.31 | 2.2.27 | 2.4.1 | 2.4.2 | 2.4.3 | 2.4.4 | 2.4.5 | 2.4.6 | 2.4.7 | 2.4.8 | 2.4.9 | 2.4.10 | 2.4.11 | 2.4.12 | 2.4.13 | 2.4.14 | 2.4.15 | 2.4.16 | 2.4.17 | 2.4.18 | 2.4.19 | 2.4.20 | 2.4.21 | 2.4.22 | 2.4.23 | 2.4.24 | 2.4.25 | 2.4.26 | 2.4.27 | 2.4.28 | 2.4.29 | 2.4.29:-rc1 | 2.4.29:-rc2 | 2.4.30 | 2.4.30:rc2 | 2.4.30:rc3 | 2.4.31 | 2.4.32 | 2.4.33 | 2.4.34.3 | 2.4.34.4 | 2.4.34.5 | 2.4.34.6 | 2.4.35.1 | 2.4.35.2 | 2.4.35.3 | 2.4.35.4 | 2.4.35.5 | 2.4.36 | 2.4.36.1 | 2.4.36.2 | 2.4.36.3 | 2.4.36.4 | 2.4.36.5 | 2.4.36.6 | 2.4.36.7 | 2.4.36.8 | 2.4.36.9 | 2.4.37 | 2.4.37:-rc1 | 2.4.37.1 | 2.4.37.2 | 2.4.37.3 | 2.4.37.4 | 2.4.37.5 | 2.4.37.6 | 2.6 | 2.6.0 | 2.6.1 | 2.6.2 | 2.6.10 | 2.6.11 | 2.6.11.1 | 2.6.11.2 | 2.6.11.3 | 2.6.11.4 | 2.6.11.5 | 2.6.11.6 | 2.6.11.7 | 2.6.11.8 | 2.6.11.9 | 2.6.11.10 | 2.6.11.11 | 2.6.11.12 | 2.6.12 | 2.6.12.1 | 2.6.12.2 | 2.6.12.3 | 2.6.12.4 | 2.6.12.5 | 2.6.12.6 | 2.6.13 | 2.6.13.1 | 2.6.13.2 | 2.6.13.3 | 2.6.13.4 | 2.6.13.5 | 2.6.14 | 2.6.14.1 | 2.6.14.2 | 2.6.14.3 | 2.6.14.4 | 2.6.14.5 | 2.6.14.6 | 2.6.14.7 | 2.6.15 | 2.6.15.1 | 2.6.15.2 | 2.6.15.3 | 2.6.15.4 | 2.6.15.5 | 2.6.15.6 | 2.6.15.7 | 2.6.16 | 2.6.16.1 | 2.6.16.2 | 2.6.16.3 | 2.6.16.4 | 2.6.16.5 | 2.6.16.6 | 2.6.16.7 | 2.6.16.8 | 2.6.16.9 | 2.6.16.10 | 2.6.16.11 | 2.6.16.12 | 2.6.16.13 | 2.6.16.14 | 2.6.16.15 | 2.6.16.16 | 2.6.16.17 | 2.6.16.18 | 2.6.16.19 | 2.6.16.20 | 2.6.16.21 | 2.6.16.22 | 2.6.16.23 | 2.6.16.24 | 2.6.16.25 | 2.6.16.26 | 2.6.16.27 | 2.6.16.28 | 2.6.16.29 | 2.6.16.30 | 2.6.16.31 | 2.6.16.32 | 2.6.16.33 | 2.6.16.34 | 2.6.16.35 | 2.6.16.36 | 2.6.16.37 | 2.6.16.38 | 2.6.16.39 | 2.6.16.40 | 2.6.16.41 | 2.6.16.42 | 2.6.16.43 | 2.6.16.44 | 2.6.16.45 | 2.6.16.46 | 2.6.16.47 | 2.6.16.48 | 2.6.16.49 | 2.6.16.50 | 2.6.16.51 | 2.6.16.52 | 2.6.16.53 | 2.6.16.54 | 2.6.16.55 | 2.6.16.56 | 2.6.16.57 | 2.6.16.58 | 2.6.16.59 | 2.6.16.60 | 2.6.16.61 | 2.6.16.62 | 2.6.17 | 2.6.17.1 | 2.6.17.2 | 2.6.17.3 | 2.6.17.4 | 2.6.17.5 | 2.6.17.6 | 2.6.17.7 | 2.6.17.8 | 2.6.17.9 | 2.6.17.10 | 2.6.17.11 | 2.6.17.12 | 2.6.17.13 | 2.6.17.14 | 2.6.18 | 2.6.18:rc1 | 2.6.18:rc2 | 2.6.18:rc3 | 2.6.18:rc4 | 2.6.18:rc5 | 2.6.18:rc6 | 2.6.18:rc7 | 2.6.18.1 | 2.6.18.2 | 2.6.18.3 | 2.6.18.4 | 2.6.18.5 | 2.6.18.6 | 2.6.18.7 | 2.6.18.8 | 2.6.19 | 2.6.19.1 | 2.6.19.2 | 2.6.19.3 | 2.6.19.4 | 2.6.19.5 | 2.6.19.6 | 2.6.19.7 | 2.6.20 | 2.6.20.1 | 2.6.20.2 | 2.6.20.3 | 2.6.20.4 | 2.6.20.5 | 2.6.20.6 | 2.6.20.7 | 2.6.20.8 | 2.6.20.9 | 2.6.20.10 | 2.6.20.11 | 2.6.20.12 | 2.6.20.13 | 2.6.20.14 | 2.6.20.15 | 2.6.20.16 | 2.6.20.17 | 2.6.20.18 | 2.6.20.19 | 2.6.20.20 | 2.6.20.21 | 2.6.21 | 2.6.21.1 | 2.6.21.2 | 2.6.21.3 | 2.6.21.4 | 2.6.21.5 | 2.6.21.6 | 2.6.21.7 | 2.6.22 | 2.6.22.1 | 2.6.22.2 | 2.6.22.3 | 2.6.22.4 | 2.6.22.5

1 vendor · 1 product

References

25 links

bugzilla.redhat.com/show_bug.cgi?id=529227X Refsource CONFIRM
git.kernel.orgX Refsource CONFIRM
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9734VDB EntrySignatureX Refsource OVAL
lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.htmlVendor AdvisoryX Refsource SUSE
www.ubuntu.com/usn/usn-864-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/38794Third Party AdvisoryX Refsource SECUNIA
lists.vmware.com/pipermail/security-announce/2010/000082.htmlMailing ListX Refsource MLIST
www.securityfocus.com/bid/36936VDB EntryX Refsource BID
www.mandriva.com/security/advisories?name=MDVSA-2009:329Vendor AdvisoryX Refsource MANDRIVA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6636VDB EntrySignatureX Refsource OVAL

Show all 25 references

lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/37909Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2010-0474.htmlVendor AdvisoryX Refsource REDHAT
www.redhat.com/support/errata/RHSA-2009-1670.htmlVendor AdvisoryX Refsource REDHAT
www.mandriva.com/security/advisories?name=MDVSA-2011:051Vendor AdvisoryX Refsource MANDRIVA
lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/38834Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/40218Third Party AdvisoryX Refsource SECUNIA
www.spinics.net/linux/lists/linux-nfs/msg03357.htmlMailing ListX Refsource MLIST
www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.31/ChangeLog-2.6.31-rc4X Refsource CONFIRMVendor Advisory
www.openwall.com/lists/oss-security/2009/11/05/1Mailing ListX Refsource MLIST
www.openwall.com/lists/oss-security/2009/11/05/4Mailing ListX Refsource MLIST
www.debian.org/security/2010/dsa-2005Vendor AdvisoryX Refsource DEBIAN
www.vupen.com/english/advisories/2010/0528VDB EntryX Refsource VUPEN