What’s Vulnerable › Vulnerabilities

CVE-2020-25669

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-05-26 · updated 2026-06-17
• Weakness: CWE-416

Description

A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.

Affected products

• Debian Linux: 9.0
• Linux kernel: before 4.4.245; from 4.5 before 4.9.245; from 4.10 before 4.14.208; from 4.15 before 4.19.159; from 4.20 before 5.4.79; from 5.5 before 5.9.10 — fixed in 4.14.208, 4.19.159, 4.4.245, 4.9.245, 5.4.79, 5.9.10
• NetApp Cloud Backup: all versions
• NetApp H300E Firmware: all versions
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500E Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700E Firmware: all versions
• NetApp H700S Firmware: all versions
• NetApp Solidfire & Hci Management Node: all versions
• NetApp Solidfire Baseboard Management Controller: all versions

How to fix

Upgrade to a fixed version: Linux kernel 4.14.208, 4.19.159, 4.4.245, 4.9.245. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2020/11/05/2
• http://www.openwall.com/lists/oss-security/2020/11/20/5
• https://github.com/torvalds/linux/commit/77e70d351db7de07a46ac49b87a6c3c7a60fca7e
• https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
• https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html
• https://security.netapp.com/advisory/ntap-20210702-0006/
• https://www.openwall.com/lists/oss-security/2020/11/05/2%2C
• https://www.openwall.com/lists/oss-security/2020/11/20/5%2C
• http://www.openwall.com/lists/oss-security/2020/11/05/2
• http://www.openwall.com/lists/oss-security/2020/11/20/5
• https://github.com/torvalds/linux/commit/77e70d351db7de07a46ac49b87a6c3c7a60fca7e
• https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html

Get alerted when CVE-2020-25669 or the next vulnerability affects your stack