01 Record

CVE-2020-25220

The Linux kernel 4.9.x before 4.9.233, 4.14.x before 4.14.194, and 4.19.x before 4.19.140 has a use-after-free because skcd->no_refcnt was not considered during a backport of a CVE-2020-14356 patch.

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

The Linux kernel 4.9.x before 4.9.233, 4.14.x before 4.14.194, and 4.19.x before 4.19.140 has a use-after-free because skcd->no_refcnt was not considered during a backport of a CVE-2020-14356 patch.

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.44% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 38.7% of scored records. A rank, not a probability.
NVD base score: 7.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2020-09-10 01:20Z6 YR AGO

Last updated

2024-08-04 15:33Z2 YR AGO

Reserved

2020-09-10

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-416Use After FreeVariant

Data version

5.1

Document digest

4ff76f47ea4753bfd76832b2a7074d376bab17caa7ff3e4c589bceba46f4eced

05 Affected products

VendorProductVersionsPlatforms

linuxlinux_kernelNot specified—

redhatenterprise_linuxNot specified—

redhatenterprise_mrgNot specified—

06 References

bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1868453x_refsource_MISC
git.kernel.orghttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.14.y&id=82fd2138a5ffd7e0d4320cdb669e115ee976a26ex_refsource_MISC
www.spinics.nethttps://www.spinics.net/lists/stable/msg405099.htmlx_refsource_MISC
cdn.kernel.orghttps://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.233x_refsource_MISC
cdn.kernel.orghttps://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.194x_refsource_MISC
cdn.kernel.orghttps://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.140x_refsource_MISC
security.netapp.comhttps://security.netapp.com/advisory/ntap-20201001-0004/x_refsource_CONFIRM
lists.debian.org[debian-lts-announce] 20201030 [SECURITY] [DLA 2420-1] linux security updatehttps://lists.debian.org/debian-lts-announce/2020/10/msg00032.htmlmailing-listx_refsource_MLIST
lists.debian.org[debian-lts-announce] 20201031 [SECURITY] [DLA 2420-2] linux regression updatehttps://lists.debian.org/debian-lts-announce/2020/10/msg00034.htmlmailing-listx_refsource_MLIST