What’s Vulnerable › Vulnerabilities

CVE-2019-20636

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-08 · updated 2026-06-17
• Weakness: CWE-787

Description

In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode table, as demonstrated by input_set_keycode, aka CID-cb222aed03d7.

Affected products

• Linux kernel: before 3.16.83; from 3.17 before 4.4.210; from 4.5 before 4.9.210; from 4.10 before 4.14.165; from 4.15 before 4.19.96; from 4.20 before 5.4.12 — fixed in 3.16.83, 4.14.165, 4.19.96, 4.4.210, 4.9.210, 5.4.12
• NetApp Cloud Backup: all versions
• NetApp Fas 8300: all versions
• NetApp Fas 8700: all versions
• NetApp Fas A400: all versions
• NetApp Fas Baseboard Management Controller A220: all versions
• NetApp Fas Baseboard Management Controller A320: all versions
• NetApp Fas Baseboard Management Controller A800: all versions
• NetApp Fas Baseboard Management Controller C190: all versions
• NetApp H300S: all versions
• NetApp H410S: all versions
• NetApp H500S: all versions
• NetApp H610C: all versions
• NetApp H610S: all versions
• NetApp H615C: all versions
• NetApp H700S: all versions
• NetApp Solidfire: all versions
• NetApp Steelstore Cloud Integrated Storage: all versions

How to fix

Upgrade to a fixed version: Linux kernel 3.16.83, 4.14.165, 4.19.96, 4.4.210. Check the vendor advisory for mitigations.

References

• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.12
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cb222aed03d798fc074be55e59d9a112338ee784
• https://github.com/torvalds/linux/commit/cb222aed03d798fc074be55e59d9a112338ee784
• https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
• https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html
• https://security.netapp.com/advisory/ntap-20200430-0004/
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.12
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cb222aed03d798fc074be55e59d9a112338ee784
• https://github.com/torvalds/linux/commit/cb222aed03d798fc074be55e59d9a112338ee784
• https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
• https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html
• https://security.netapp.com/advisory/ntap-20200430-0004/

Get alerted when CVE-2019-20636 or the next vulnerability affects your stack