CVE-2009-3624: Linux Kernel

Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days.

The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring, which allows local users to gain privileges or cause a denial of service (OOPS) via vectors involving calls to this function without specifying a keyring by ID, as demonstrated by a series of keyctl request2 and keyctl list commands.

Affected products

• Linux Kernel: version 2.6.24.7 only; version 2.6.25.15 only
• Linux Linux Kernel: up to and including 2.6.32; version 2.6 only; version 2.6.0 only; version 2.6.1 only; version 2.6.2 only; version 2.6.2.27.13 only; …

Published 2009-11-02. Last modified 2026-06-16.