What’s Vulnerable › Vulnerabilities

CVE-2020-14386

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-09-16 · updated 2026-06-17
• Weakness: CWE-250

Description

A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity.

Affected products

• Debian Linux: 9.0
• Fedoraproject Fedora: 33
• Linux kernel: from 4.6 before 4.9.239; from 4.10 before 4.14.201; from 4.15 before 4.19.150; from 4.20 before 5.4.64; from 5.5 before 5.8.8; 5.9.0-rc1, 5.9.0-rc2, 5.9.0-rc3 — fixed in 4.14.201, 4.19.150, 4.9.239, 5.4.64, 5.8.8
• openSUSE Leap: 15.1

How to fix

Upgrade to a fixed version: Linux kernel 4.14.201, 4.19.150, 4.9.239, 5.4.64. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html
• http://packetstormsecurity.com/files/159565/Kernel-Live-Patch-Security-Notice-LSN-0072-1.html
• http://www.openwall.com/lists/oss-security/2021/09/17/2
• http://www.openwall.com/lists/oss-security/2021/09/17/4
• http://www.openwall.com/lists/oss-security/2021/09/21/1
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14386
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=acf69c946233259ab4d64f8869d4037a198c7f06
• https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html
• https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html
• https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNCPXERMUHPSGF6S2VVFL5NVVPBBFB63/
• https://seclists.org/oss-sec/2020/q3/146

Get alerted when CVE-2020-14386 or the next vulnerability affects your stack