CVE-2020-10711

The CVE-2020-10711 entry concerns a NULL pointer dereference in the Linux kernel SELinux subprocess during CIPSO category bitmap import. Affected are kernel versions before 5.7; processing the CIPSO restricted bitmap tag in cipso_v4_parsetag_rbm sets a security attribute indicating the bitmap exi...

CVE-2020-25705

CVE-2020-25705 is a Linux kernel ICMP handling flaw that lets an off-path attacker bypass UDP source port randomization and rapidly scan open UDP ports. Affected products include various kernel versions and embedded/Linux-based devices; remediation is via kernel updates (e.g., CentOS/AlmaLinux ad...

CVE-2020-10732

CVE-2020-10732 describes a Linux Kernel flaw in the Userspace core dumps implementation. According to connected IBM bulletin entries, the issue: allows a local authenticated attacker to obtain sensitive information or cause a program crash by exploiting the core-dump handling path. The vulnerabil...

CVE-2020-14385

CVE-2020-14385 affects the Linux kernel prior to 5.9-rc4. A failure in the XFS file system metadata validator can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt, potentially shutting down the filesystem or making it inaccessible until remounted, resulting ...

CVE-2020-11668

CVE-2020-11668 affects the Linux kernel drivers/media/usb/gspca/xirlink_cit.c (Xirlink camera USB driver). The issue arises from mishandling invalid USB descriptors in this driver, as reported in multiple advisories. The connected documents confirm that this vulnerability can enable a local attac...

CVE-2020-27777

The CVE-2020-27777 issue concerns the Linux kernel on PowerPC: RTAS memory accesses in the userspace-to-kernel path allow a local, root-like user on a locked-down guest (Secure Boot) running on PowerVM or KVM/pseries to escalate privileges to the running kernel. Root cause is an improper handling...

CVE-2020-25285

CVE-2020-25285 is a race condition in the Linux kernel hugetlb sysctl handlers (mm/hugetlb.c) that could allow a local attacker to corrupt memory or trigger NULL pointer dereferences. Public docs (e.g., ChangeLog-5.8.8) indicate the fix was released in kernel 5.8.8; Ubuntu/Debian advisories refer...

CVE-2020-10766

CVE-2020-10766 is a Linux kernel vulnerability tied to the SSBD mitigation logic, enabling a local attacker to temporarily disable SSBD during a context switch due to per-task STIPB switching. Connected advisories confirm affected kernels (e.g., Linux 5.4.x/5.8 era) and provide patch info: Debian...

CVE-2020-12654

CVE-2020-12654 affects the Linux kernel prior to 5.5.4. The vulnerability is a heap-based buffer overflow in mwifiex_ret_wmm_get_status() (drivers/net/wireless/marvell/mwifiex/wmm.c) caused by an incorrect memcpy when processing WMM parameters from a remote AP. A crafted AP can trigger overflow a...

CVE-2020-10942

CVE-2020-10942 affects Linux kernel pre-5.5.8: vhost-net get_raw_socket fails to validate sk_family in drivers/vhost/net.c, enabling local attackers to induce kernel stack corruption via crafted syscalls, with potential DoS or privilege escalation. The connected doc from ALAS2LIVEPATCH-2020-015 n...

CVE-2020-12653

CVE-2020-12653 affects the Linux kernel prior to 5.5.4, caused by an incorrect memcpy in the mwifiex_cmd_append_vsie_tlv() function (drivers/net/wireless/marvell/mwifiex/scan.c). This enables a local attacker to gain elevated privileges or cause a denial of service due to a buffer overflow. Conne...

CVE-2020-10768

CVE-2020-10768 affects the Linux kernel prior to 5.8-rc1, where prctl() can re-enable indirect branch speculation after it has been disabled, enabling Spectre v2-style disclosure. The vulnerability has Local attack vector and primarily impacts confidentiality; no exploitation details are provided...

CVE-2020-10690

The CVE-2020-10690 entry affects Linux kernel versions before 5.5. It is caused by a race between the release of ptp_clock and the cdev during resource deallocation, which can free the cdev structure while a high-privileged process holding /dev/ptpX is sleeping. When the underlying device is remo...

CVE-2020-14351

CVE-2020-14351 is a Linux kernel vulnerability in the perf subsystem that enables a local attacker with perf event access to trigger a use-after-free, potentially corrupt memory and escalate privileges. Public sources in connected advisories describe the vulnerability as a local use-after-free af...

CVE-2020-29374

CVE-2020-29374 affects the Linux kernel and was fixed in 5.7.3. It concerns the get_user_pages (gup) implementation used for copy-on-write pages: when handling read operations, it may grant unintended write access, risking information disclosure or data corruption (COW cross-process leakage). Sev...

CVE-2020-12826

CVE-2020-12826 affects the Linux kernel before 5.6.5. The root cause is an integer overflow in exec_id (include/linux/sched.h) due to 32-bit sizing, which can allow a child process to send an arbitrary signal to a parent process in a different security domain, bypassing protection. A patched vers...

CVE-2020-10767

CVE-2020-10767 affects the Linux kernel before 5.8-rc1, where Enhanced IBPB mitigation is disabled when STIBP is unavailable or when IBRS is available, enabling a Spectre V2–style attack on local confidentiality. Connected advisories confirm Linux kernel mitigations (IBPB/SSBD) and note a patched...

CVE-2019-20811

CVE-2019-20811 affects the Linux kernel prior to 5.0.6, where a reference count is mishandled in rx_queue_add_kobject() and netdev_queue_add_kobject() within net/core/net-sysfs.c (CID-a3e23f719f5c). The issue was fixed in kernel 5.0.6 (ChangeLog-5.0.6). Exploitation would require local access and...

CVE-2020-12769

CVE-2020-12769 affects the Linux kernel prior to 5.4.17. The issue is in drivers/spi/spi-dw.c, where concurrent calls to dw_spi_irq and dw_spi_transfer_one can trigger a kernel panic (local exploit). The vulnerability is fixed in Linux kernel 5.4.17 (see ChangeLog-5.4.17). No exploit details are ...

CVE-2020-12464

CVE-2020-12464 is a Linux kernel use-after-free in the USB core path. The vulnerability stems from usb_sg_cancel in drivers/usb/core/message.c where a transfer can occur without a proper reference, enabling a local attacker to potentially crash or execute code. Connected documents confirm this is...

CVE-2020-24394

CVE-2020-24394 affects the Linux kernel before 5.7.8 in the NFS server (fs/nfsd/vfs.c). The root cause is that ACL-less filesystems do not apply the current umask when creating new objects, allowing an attacker with local access to set incorrect permissions. Public details in connected advisories...

CVE-2020-25212

CVE-2020-25212 affects the NFSv4 client in the Linux kernel and is caused by a TOCTOU mismatch where a size check is performed in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c. This can allow a local attacker to corrupt memory or cause unspecified impacts. The issue is addressed in the upstream k...

CVE-2020-14381

CVE-2020-14381 is a vulnerability in the Linux kernel futex implementation. A local attacker can corrupt memory or escalate privileges when creating a futex on a filesystem that is about to be unmounted. The issue is local, with attack vector and conditions described as exploitation requiring loc...

CVE-2020-27786

CVE-2020-27786 affects the Linux kernel MIDI subsystem (rawmidi) with a use-after-free in the MIDI ioctl handling path. A local attacker with access to issue ioctl commands to MIDI devices could trigger memory corruption, potentially enabling privilege escalation. Public documentation in connecte...

CVE-2020-25284

The CVE-2020-25284 issue concerns the Rados Block Device (rbd) driver in the Linux kernel. Affected code path is in the rbd subsystem (drivers/block/rbd.c) where permission checks to access rbd devices were incomplete, enabling a local attacker to map or unmap rbd block devices. Multiple connecte...

CVE-2020-11608

CVE-2020-11608 affects Linux kernel versions prior to 5.6.1. The issue is a NULL pointer dereference in the ov511_mode_init_regs and ov518_mode_init_regs paths of drivers/media/usb/gspca/ov519.c when there are zero USB endpoints, potentially enabling local denial of service. The vulnerability is ...

CVE-2020-15780

CVE-2020-15780 – Linux kernel configfs ACPI lockdown bypass Affects: Linux kernel drivers/acpi/acpi_configfs.c prior to 5.7.7 (observed in Unity Linux advisories). Impact: Injection of malicious ACPI tables via configfs could bypass lockdown and secure boot protections. Local attacker privileges ...

CVE-2020-25656

CVE-2020-25656 is a Linux kernel use-after-free in the console subsystem related to ioctls KDGKBSENT and KDSKBSENT. A local attacker could read memory out of bounds, impacting data confidentiality. Several advisories (CloudLinux, Amazon Linux, CentOS/RHEL, Cloud Foundry/usn, etc.) reference this ...

CVE-2020-28974

CVE-2020-28974 is a slab-out-of-bounds read in the Linux kernel’s fbcon driver, fixed in kernel 5.9.7. The flaw arises in KD_FONT_OP_COPY within drivers/tty/vt/vt.c and could allow a local attacker to read privileged kernel memory or cause a kernel crash. Several connected documents describe the ...

CVE-2020-13974

CVE-2020-13974 affects the Linux kernel in drivers/tty/vt/keyboard.c, caused by a signed integer overflow in k_ascii when invoked repeatedly. Connected docs confirm impacted products include Linux kernel 4.4–5.7.1 and note potential local code execution risk (IBM bulletin and MSRC description) th...

CVE-2019-20812

CVE-2019-20812 affects the Linux kernel prior to 5.4.7. The issue is in the function prb_calc_retire_blk_tmo() in net/packet/af_packet.c , which can cause a denial of service (high CPU usage and soft lockup) in a failure case when using TPACKET_V3 . Impact is localized (local access required) and...

CVE-2020-11609

CVE-2020-11609 affects the Linux kernel, specifically the stv06xx USB video driver family. The issue arises from mishandling of invalid USB device descriptors in the stv06xx.c and stv06xx_pb0100.c code paths, leading to a NULL pointer dereference. This can allow a locally‑present attacker with ac...

CVE-2020-25645

Summary: CVE-2020-25645 describes a confidentiality flaw in the Linux kernel’s GENEVE tunnel code when IPsec is used to encrypt traffic for the tunnel’s UDP port. In kernels before 5.9-rc7, traffic between two Geneve endpoints may be left unencrypted, allowing an attacker between the endpoints to...

CVE-2019-20636

CVE-2019-20636 affects the Linux kernel prior to 5.4.12. The vulnerability is an out-of-bounds write in drivers/input/input.c via a crafted keycode table in input_set_keycode, enabling a local attacker with root privileges to corrupt memory and potentially execute arbitrary code or cause a denial...

CVE-2019-20908

CVE-2019-20908 affects the Linux kernel up to 5.3: in drivers/firmware/efi/efi.c, efivar_ssdt ACPI variable permissions can be too permissive, enabling local attackers to bypass lockdown or secure boot restrictions. Affected: Linux kernels prior to 5.4 (as referenced by Unity Linux and MiracleLin...

CVE-2020-12768

CVE-2020-12768 affects the Linux kernel before 5.6, specifically svm_cpu_uninit in arch/x86/kvm/svm.c. The issue is a memory leak that occurs at boot time; third parties dispute its severity, noting the leak is one-time and its size is negligible and not triggerable at will. Public sources in con...

CVE-2019-20810

CVE-2019-20810 affects the Linux kernel’s go7007 driver: go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c fails to call snd_card_free on a failure path, causing a memory leak (CID-9453264ef586). Public docs specify this vulnerability exists in kernels before 5.6. The described remediation...

CVE-2020-12652

CVE-2020-12652 concerns the Linux kernel. The issue is in the function "__mptctl_ioctl" in drivers/message/fusion/mptctl.c, where an operation may hold an incorrect lock during an ioctl, enabling a local race condition (double fetch). The vulnerability affects Linux kernels prior to 5.4.14. Explo...

CVE-2019-19338

CVE-2019-19338 describes a flaw in the Linux kernel related to the handling of TAA/MDS interactions in TSX-enabled cascaded environments, affecting guests on Cascade Lake hosts with TSX enabled and a host-side fix for CVE-2019-11135 in kernels prior to 5.5. The Connected documents confirm affecte...

CVE-2020-11669

CVE-2020-11669 affects the Linux kernel before 5.2 on the powerpc platform. The issue is in arch/powerpc/kernel/idle_book3s.S where save/restore for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR is missing (CID-53a712bae5dd). This can impact availability (per CVSS 3.1: Availabili...

CVE-2020-15437

CVE-2020-15437 affects the Linux kernel up to version 5.7.x, where a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() can be triggered by an uninitialized p->serial_in, enabling local denial of service. Affected component: kernel serial driver (8250) ...

CVE-2020-12657

CVE-2020-12657 affects the Linux kernel before 5.6.5 due to a use-after-free in bfq_idle_slice_timer_body within bfq-iosched.c. The connected advisories (Unity Linux UTSA-2026-00x, Red Hat RHSA/CESA entries, CentOS plugin references) confirm kernel versions impacted and reference the 5.6.5 patch/...

CVE-2020-28915

CVE-2020-28915 is a Linux kernel vulnerability in the fbcon framebuffer code, where a buffer over-read before 5.8.15 could allow a local attacker to read kernel memory. The issue is caused by improper bounds handling in the framebuffer font-related path used by fbcon. Affected fix: upstream patch...

CVE-2020-29370

CVE-2020-29370 (Linux kernel): An issue in kmem_cache_alloc_bulk (mm/slub.c) before 5.5.11 where the slowpath path does not increment the TID as required (CID-fd4d9c7d0c71). Affected: Linux kernel prior to 5.5.11. Impact described in connected advisories as a vulnerability in the kernel memory al...

CVE-2020-29371

CVE-2020-29371 affects Linux kernel romfs_dev_read (fs/romfs/storage.c) prior to 5.8.4, where uninitialized memory leaks to userspace. The vulnerability stems from uninitialized memory paths, enabling leakage to user space. Affected component is the ROMFS code in the kernel; no exploit details ar...

CVE-2020-26088

CVE-2020-26088 affects the Linux kernel up to version 5.8.2, where a missing CAP_NET_RAW check in NFC socket creation (net/nfc/rawsock.c) could let a local attacker create raw sockets and bypass security mechanisms. This is demonstrated in multiple Nessus advisories (Unity Linux/OpenSUSE/EulerOS ...

CVE-2020-10781

CVE-2020-10781 affects the Linux kernel ZRAM module: a local attacker who can read /sys/class/zram-control/hot_add can create ZRAM device nodes in /dev, and repeated reads can allocated memory and trigger OOM killer, potentially making the system inoperable. Connected advisories (e.g., ALAS2KERNE...

CVE-2020-14416

CVE-2020-14416 is a Linux kernel issue fixed in 5.4.16. A race condition in tty->disc_data handling for slip and slcan line disciplines can cause a use-after-free, affecting drivers/net/slip/slip.c and drivers/net/can/slcan.c. The connected Nessus advisories reproduce the vulnerability across ...

CVE-2020-29373

CVE-2020-29373 affects the Linux kernel (pre-5.6) in fs/io_uring.c, where the root directory is unsafely handled during path lookups inside a mount namespace, allowing a process to escape to unintended filesystem locations. The issue is confirmed by the CVE description and linked ChangeLog-5.6 an...

CVE-2020-10720

CVE-2020-10720 : A local attacker can crash the system due to a flaw in the Linux kernel’s GRO implementation in versions older than 5.2. The issue is specifically in GRO handling in the kernel networking path, not a remote exploit. The connected advisories reiterate the same root cause and indic...