CVE-2011-2184

The key_replace_session_keyring function in security/keys/process_keys.c in the Linux kernel before 2.6.39.1 does not initialize a certain structure member, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a KEYCTL_SESSION_TO_PARENT argument to the keyctl function, a different vulnerability than CVE-2010-2960.

• CWE-476

• http://alt.swiecki.net/linux_kernel/sys_open-kmem_cache_alloc-2.6.39-rc4.txtBroken Link
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f7285b5d631fd6096b11c6af0058ed3a2b30ef4e
• http://securityreason.com/securityalert/8371Patch, Third Party Advisory
• http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39.1Broken Link
• http://www.openwall.com/lists/oss-security/2011/06/03/2Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2011/06/06/2Mailing List, Patch, Third Party Advisory
• https://lkml.org/lkml/2011/5/23/199Third Party Advisory
• https://lkml.org/lkml/2011/5/24/502Third Party Advisory
• https://lkml.org/lkml/2011/5/25/265Patch, Third Party Advisory
• http://alt.swiecki.net/linux_kernel/sys_open-kmem_cache_alloc-2.6.39-rc4.txtBroken Link
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f7285b5d631fd6096b11c6af0058ed3a2b30ef4e
• http://securityreason.com/securityalert/8371Patch, Third Party Advisory
• http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39.1Broken Link
• http://www.openwall.com/lists/oss-security/2011/06/03/2Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2011/06/06/2Mailing List, Patch, Third Party Advisory
• https://lkml.org/lkml/2011/5/23/199Third Party Advisory
• https://lkml.org/lkml/2011/5/24/502Third Party Advisory
• https://lkml.org/lkml/2011/5/25/265Patch, Third Party Advisory

Published

Sep 6, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-2178The virSecurityManagerGetPrivateData function in security/se…
• CVE-2011-2179Multiple cross-site scripting (XSS) vulnerabilities in confi…
• CVE-2011-2180Cross-site scripting (XSS) vulnerability in dereferer.php in…
• CVE-2011-2181Multiple SQL injection vulnerabilities in A Really Simple Ch…
• CVE-2011-2182The ldm_frag_add function in fs/partitions/ldm.c in the Linu…
• CVE-2011-2183Race condition in the scan_get_next_rmap_item function in mm…
• CVE-2011-2185Fabric before 1.1.0 allows local users to overwrite arbitrar…
• CVE-2011-2186Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2011-2187xscreensaver before 5.14 crashes during activation and leave…7.8
• CVE-2011-2188LuaExpat before 1.2.0 does not properly detect recursion dur…
• CVE-2011-2189net/core/net_namespace.c in the Linux kernel 2.6.32 and earl…7.5
• CVE-2011-2190The generate_admin_password function in Cherokee before 1.2.…