CVE-2020-35519

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-06 · updated 2026-06-17
Weakness: CWE-125

Description

An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Affected products

Linux kernel: from 2.6.12 before 4.4.248; from 4.5 before 4.9.248; from 4.10 before 4.14.211; from 4.15 before 4.19.162; from 4.20 before 5.4.82; from 5.5 before 5.9.13 — fixed in 4.14.211, 4.19.162, 4.4.248, 4.9.248, 5.4.82, 5.9.13
NetApp Cloud Backup: all versions
NetApp H300E Firmware: all versions
NetApp H300S Firmware: all versions
NetApp H410C Firmware: all versions
NetApp H410S Firmware: all versions
NetApp H500E Firmware: all versions
NetApp H500S Firmware: all versions
NetApp H700E Firmware: all versions
NetApp H700S Firmware: all versions
NetApp Solidfire Baseboard Management Controller Firmware: all versions

How to fix

Upgrade to a fixed version: Linux kernel 4.14.211, 4.19.162, 4.4.248, 4.9.248. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-35519 or the next vulnerability affects your stack