What’s Vulnerable › Vulnerabilities

CVE-2018-20169

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-12-17 · updated 2026-06-17
• Weakness: CWE-400

Description

An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04
• Debian Linux: 8.0
• Linux kernel: before 3.16.63; from 3.17 before 3.18.129; from 3.19 before 4.4.167; from 4.5 before 4.9.145; from 4.10 before 4.14.88; from 4.15 before 4.19.9 — fixed in 3.16.63, 3.18.129, 4.14.88, 4.19.9, 4.4.167, 4.9.145

How to fix

Upgrade to a fixed version: Linux kernel 3.16.63, 3.18.129, 4.14.88, 4.19.9. Check the vendor advisory for mitigations.

References

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=704620afc70cf47abb9d6a1a57f3825d2bca49cf
• https://access.redhat.com/errata/RHSA-2019:3309
• https://access.redhat.com/errata/RHSA-2019:3517
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.9
• https://github.com/torvalds/linux/commit/704620afc70cf47abb9d6a1a57f3825d2bca49cf
• https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html
• https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html
• https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html
• https://usn.ubuntu.com/3879-1/
• https://usn.ubuntu.com/3879-2/
• https://usn.ubuntu.com/4094-1/
• https://usn.ubuntu.com/4118-1/

Get alerted when CVE-2018-20169 or the next vulnerability affects your stack