What’s Vulnerable › Vulnerabilities

CVE-2020-29368

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-11-28 · updated 2026-06-17
• Weakness: CWE-362

Description

An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check, aka CID-c444eb564fb1.

Affected products

• Linux kernel: from 4.5.5 before 4.9.228; from 4.10 before 4.14.185; from 4.15 before 4.19.129; from 4.20 before 5.4.48; from 5.5 before 5.7.5 — fixed in 4.14.185, 4.19.129, 4.9.228, 5.4.48, 5.7.5
• NetApp Cloud Backup: all versions
• NetApp Element Software: all versions
• NetApp H410C Firmware: all versions
• NetApp Hci Bootstrap Os: all versions
• NetApp Hci Management Node: all versions
• NetApp Solidfire: all versions

How to fix

Upgrade to a fixed version: Linux kernel 4.14.185, 4.19.129, 4.9.228, 5.4.48. Check the vendor advisory for mitigations.

References

• https://bugs.chromium.org/p/project-zero/issues/detail?id=2045
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.5
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c444eb564fb16645c172d550359cb3d75fe8a040
• https://security.netapp.com/advisory/ntap-20210108-0002/
• https://bugs.chromium.org/p/project-zero/issues/detail?id=2045
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.5
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c444eb564fb16645c172d550359cb3d75fe8a040
• https://security.netapp.com/advisory/ntap-20210108-0002/

Get alerted when CVE-2020-29368 or the next vulnerability affects your stack