CVE-2009-2698: Canonical Ubuntu Linux

High severity, CVSS 7.8. EPSS: 7.1% chance of exploitation in the next 30 days.

The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 8.10 only; version 9.04 only
• Fedoraproject Fedora: version 10 only
• Linux Linux Kernel: before 2.6.19 (fixed in 2.6.19)
• Red Hat Enterprise Linux Desktop: version 4.0 only; version 5.0 only
• Red Hat Enterprise Linux Eus: version 4.8 only; version 5.3 only
• Red Hat Enterprise Linux Server: version 4.0 only; version 5.0 only
• Red Hat Enterprise Linux Server Aus: version 5.3 only
• Red Hat Enterprise Linux Workstation: version 4.0 only; version 5.0 only
• Suse Linux Enterprise Desktop: version 10 only
• Suse Linux Enterprise Server: version 9 only; version 10 only
• VMware ESXi: version 4.0 only
• VMware vCenter Server: version 4.0 only

Published 2009-08-27. Last modified 2026-06-16.