What’s Vulnerable › Vulnerabilities

CVE-2020-27820

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-11-03 · updated 2026-06-17
• Weakness: CWE-416

Description

A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if "unbind" the driver).

Affected products

• Fedoraproject Fedora: 33
• Linux kernel: from 2.6.12 (excl.) before 5.4.162; from 5.5 (excl.) before 5.10.82; from 5.11 (excl.) before 5.15.5; 2.6.12, 2.6.12-rc2, 2.6.12-rc3, 2.6.12-rc4, 2.6.12-rc5, 2.6.12-rc6 — fixed in 5.10.82, 5.15.5, 5.4.162
• Oracle Communications Cloud Native Core Binding Support Function: 22.1.3
• Oracle Communications Cloud Native Core Network Exposure Function: 22.1.1
• Oracle Communications Cloud Native Core Policy: 22.2.0

How to fix

Upgrade to a fixed version: Linux kernel 5.10.82, 5.15.5, 5.4.162. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1901726
• https://lore.kernel.org/dri-devel/20201103194912.184413-2-jcline%40redhat.com/
• https://lore.kernel.org/dri-devel/20201103194912.184413-3-jcline%40redhat.com/
• https://lore.kernel.org/dri-devel/20201103194912.184413-4-jcline%40redhat.com/
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1901726
• https://lore.kernel.org/dri-devel/20201103194912.184413-2-jcline%40redhat.com/
• https://lore.kernel.org/dri-devel/20201103194912.184413-3-jcline%40redhat.com/
• https://lore.kernel.org/dri-devel/20201103194912.184413-4-jcline%40redhat.com/
• https://www.oracle.com/security-alerts/cpujul2022.html

Get alerted when CVE-2020-27820 or the next vulnerability affects your stack