CVE-2009-2844: Linux Kernel

High severity, CVSS 7.8. EPSS: 3.4% chance of exploitation in the next 30 days.

cfg80211 in net/wireless/scan.c in the Linux kernel 2.6.30-rc1 and other versions before 2.6.31-rc6 allows remote attackers to cause a denial of service (crash) via a sequence of beacon frames in which one frame omits an SSID Information Element (IE) and the subsequent frame contains an SSID IE, which triggers a NULL pointer dereference in the cmp_ies function. NOTE: a potential weakness in the is_mesh function was also addressed, but the relevant condition did not exist in the code, so it is not a vulnerability.

Affected products

• Linux Kernel: version 2.6.24.7 only; version 2.6.25.15 only
• Linux Linux Kernel: up to and including 2.6.16.31; version 2.6 only; version 2.6.0 only; version 2.6.1 only; version 2.6.10 only; version 2.6.11 only; …

Published 2009-08-18. Last modified 2026-06-16.