Description
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | udev | 0.125-7+lenny1 | DSA-1772-1 |
| Debian 4.0 | udev | 0.105-4etch1 | DSA-1772-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | udev +2 | 095-14.20.el5_3 | RHSA-2009:0427 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | py3-udev +1 | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Linux udev Netlink Local Privilege Escalation
exploit/linux/local/udev_netlink
Exploit-DB 3
- Linux Kernel UDEV < 1.4.1 - 'Netlink' Local Privilege Escalation (Metasploit) EDB-21848 · local · Oct 10, 2012 · verified
- Linux Kernel 2.6 (Gentoo / Ubuntu 8.10/9.04) UDEV < 1.4.1 - Local Privilege Escalation (2) EDB-8572 · local · Apr 30, 2009 · verified
- Linux Kernel 2.6 (Debian 4.0 / Ubuntu / Gentoo) UDEV < 1.4.1 - Local Privilege Escalation (1) EDB-8478 · local · Apr 20, 2009 · verified
GitHub 2 repositories
-
0b0111100/2009 ★ 0 · Sep 7, 2026
Linux Kernel Exploits -> CVE-2009-1185 + CVE-2009-1337 + CVE-2009-2692 + CVE-2009-2698 + CVE-2009-3547
-
aish19siddiqua-commits/mtechweek_04 ★ 0 · Aug 22, 2026
Metasploit-based penetration test on an isolated Metasploitable2 lab VM — remote exploitation via DistCC (CVE-2004-2687), privilege escalation via udev netlink (CVE-2009-1185), and vsftpd 2.3.4 backd…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2009:0427 Red Hat Security Advisory: udev security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1772-1 udev - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20090417 rPSA-2009-0063-1 udev mailing-list
- http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0063
- oval:org.mitre.oval:def:5975 vdb-entry signature
- 34801 third-party-advisory
- 35766 third-party-advisory
- SUSE-SA:2009:020 vendor-advisory
- MDVSA-2009:104 vendor-advisory
- SSA:2009-111-01 vendor-advisory
- FEDORA-2009-3712 vendor-advisory
- DSA-1772 vendor-advisory
- GLSA-200904-18 vendor-advisory
- ADV-2009-1865 vdb-entry
- oval:org.mitre.oval:def:10925 vdb-entry signature
- 34536 vdb-entry
- 1022067 vdb-entry
- http://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=e2b362d9f23d4c63018709ab5f81a02f72b91e75
- RHSA-2009:0427 vendor-advisory
- MDVSA-2009:103 vendor-advisory
- 34776 third-party-advisory
- 34731 third-party-advisory
- [Security-announce] 20090710 VMSA-2009-0009 ESX Service Console updates for udev, sudo, and curl mailing-list
- 34753 third-party-advisory
- 34785 third-party-advisory
- 34787 third-party-advisory
- FEDORA-2009-3711 vendor-advisory
- https://launchpad.net/bugs/cve/2009-1185
- ADV-2009-1053 vdb-entry
- SUSE-SA:2009:025 vendor-advisory
- USN-758-1 vendor-advisory
- http://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=e86a923d508c2aed371cdd958ce82489cf2ab615
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691
- 34771 third-party-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- 20090711 VMSA-2009-0009 ESX Service Console updates for udev, sudo, and curl mailing-list
- 34750 third-party-advisory
- http://wiki.rpath.com/Advisories:rPSA-2009-0063
- http://www.vmware.com/security/advisories/VMSA-2009-0009.html
- https://bugzilla.redhat.com/show_bug.cgi?id=495051
- 8572 exploit