CVE-2020-36791: net_sched: keep alloc_hash updated after hash allocation
Noroxi assessment
Priority: Monitor (action score 28/100)
- The sources we track (CISA KEV, Exploit-DB, Metasploit, Nuclei, GitHub) show no public exploit code or exploitation in the wild.
- Probability of exploitation in the next 30 days: 0.19% (FIRST EPSS).
- Someone with local access to the system can trigger it. A low-privileged account is enough. No user action is required. No special conditions are required; it is repeatable.
- Fixed version: Linux Linux 0d1c3530e1bd38382edef72591b78e877e0edcd3, 4.14.175, 4.19.114.
Low priority for now. Upgrade to Linux Linux 0d1c3530e1bd38382edef72591b78e877e0edcd3, 4.14.175, 4.19.114 or later.
Generated automatically from the record's data: CVSS (NVD and CNA), CISA KEV and SSVC, FIRST EPSS, exploit sources, fixed versions. How we calculate it
Primary sources: NVD · CVE.org · FIRST EPSS
In the Linux kernel, the following vulnerability has been resolved: net_sched: keep alloc_hash updated after hash allocation In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") I moved cp->hash calculation before the first tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched. This difference could lead to another out of bound access. cp->alloc_hash should always be the size allocated, we should update it after this tcindex_alloc_perfect_hash().
- Published
- May 7, 2025
- Updated
- Aug 5, 2026
- EPSS
- 0.1% · 9th percentile
- CWE
- CWE-125
Report tools
Action score
28
Low priority for now.
- CVSS
- 28 / 40 · 7.1 / 10
- CISA KEV
- 0 / 30 · Not listed
- EPSS
- 0 / 30 · 0.1%
CNA vs NVD score
- NVD
- 7.1
- CNA · Linux
- 7.8
- 0.7 point gap
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The score given by the assigning authority versus NVD’s independent score. A gap means the severity is contested.
Get told when this record changes
- Not in KEV: no record of exploitation in the wild
- No public exploit code on record
- A fix has been released
If any of these changes, we'll tell you in the daily email digest.
Is your version affected? Check itNoroxi analysis
What does it mean in your environment?
The assessment above is generated automatically from the record's data; it doesn't know your environment. Our team verifies on your systems whether this vulnerability is actually exploitable and which mitigation is enough.
We use this product, ask for helpAffected systems
Is your version affected?
Pick the product and type the version you run. It's compared with this record's version ranges in your browser; the version isn't sent anywhere.
| Vendor | Product | CPE |
|---|---|---|
| linux | linux kernel | cpe:2.3:o:linux:linux_kernel |
Versions reported by the vendor
Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.
Linux Linux
- 73c29d2f6f8ae731b1e09051b69ed3ba2319482b and later · before d6cdc5bb19b595486fb2e6661e5138d73a57f454affected · git
- b974ac51f5834a729de252fc5c1c9de9efd79b45 and later · before c4453d2833671e3a9f6bd52f0f581056c3736386affected · git
- 6cb448ee493c8a514c9afa0c346f3f5b3227de85 and later · before 9f8b6c44be178c2498a00b270872a6e30e7c8266affected · git
- 478c4b2ffd44e5186c7e22ae7c38a86a5b9cfde5 and later · before 557d015ffb27b672e24e6ad141fd887783871dc2affected · git
- dd8142a6fa5270783d415292ec8169f4ea2a5468 and later · before d23faf32e577922b6da20bf3740625c1105381bfaffected · git
- 2c66ff8d08f81bcf8e8cb22e31e39c051b15336a and later · before bd3ee8fb6371b45c71c9345cc359b94da2ddefa9affected · git
- 599be01ee567b61f4471ee8078870847d0a11e8e and later · before 0d1c3530e1bd38382edef72591b78e877e0edcd3affected · git
- 4.4.214 and later · before 4.4.218affected · semver
- 4.9.214 and later · before 4.9.218affected · semver
- 4.14.171 and later · before 4.14.175affected · semver
Affected versions · NVD (7)
NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.
- linux linux kernel4.4.214 and later · before 4.4.218
- linux linux kernel4.9.214 and later · before 4.9.218
- linux linux kernel4.14.171 and later · before 4.14.175
- linux linux kernel4.19.103 and later · before 4.19.114
- linux linux kernel5.4.19 and later · before 5.4.29
- linux linux kernel5.5.3 and later · before 5.5.14
- linux linux kernel5.6
Package-level exposure
OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.
| Ecosystem | Package | Affected range | Fix |
|---|---|---|---|
| Debian:12 | linux | before 5.5.17-1 | 5.5.17-1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | kernel-64kb | before 5.3.18-150300.59.207.1 | 5.3.18-150300.59.207.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | kernel-default-base | before 5.3.18-150300.59.207.1.150300.18.124.1 | 5.3.18-150300.59.207.1.150300.18.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | kernel-docs | before 5.3.18-150300.59.207.1 | 5.3.18-150300.59.207.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | kernel-obs-build | before 5.3.18-150300.59.207.1 | 5.3.18-150300.59.207.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | kernel-preempt | before 5.3.18-150300.59.207.1 | 5.3.18-150300.59.207.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | kernel-source | before 5.3.18-150300.59.207.1 | 5.3.18-150300.59.207.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | kernel-syms | before 5.3.18-150300.59.207.1 | 5.3.18-150300.59.207.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kernel-default | before 4.12.14-122.261.1 | 4.12.14-122.261.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_69 | before 1-8.3.1 | 1-8.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP3 | kernel-default | before 5.3.18-150300.59.207.1 | 5.3.18-150300.59.207.1 |
| SUSE:Linux Enterprise Live Patching 15 SP3 | kernel-livepatch-SLE15-SP3_Update_58 | before 1-150300.7.3.1 | 1-150300.7.3.1 |
| SUSE:Linux Enterprise Micro 5.1 | kernel-rt | before 5.3.18-150300.211.1 | 5.3.18-150300.211.1 |
| SUSE:Linux Enterprise Micro 5.1 | kernel-source-rt | before 5.3.18-150300.211.1 | 5.3.18-150300.211.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-source | before 4.12.14-122.261.1 | 4.12.14-122.261.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-syms | before 4.12.14-122.261.1 | 4.12.14-122.261.1 |
| SUSE:Linux Enterprise Server 15 SP3-LTSS | kernel-zfcpdump | before 5.3.18-150300.59.207.1 | 5.3.18-150300.59.207.1 |
Same product
linux: all recordsOther highest-scoring records for the same primary product.
- CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV90Now
- CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe…KEV89Now
- CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV85Now
Published before and after this one in the same product
- ← EarlierCVE-2024-58100May 5, 2025 · bpf: check changes_pkt_data property for extension programs22Monitor
- ← EarlierCVE-2024-58237May 5, 2025 · bpf: consider that tail calls invalidate packet pointers22Monitor
- Later →CVE-2025-37802May 8, 2025 · ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"22Monitor
Remediation
Which version to upgrade to
Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.
| Product / package | Fixed version | Source |
|---|---|---|
| Linux Linux | 0d1c3530e1bd38382edef72591b78e877e0edcd3 | Vendor (CNA) |
| Linux Linux | 4.14.175 | Vendor (CNA) |
| Linux Linux | 4.19.114 | Vendor (CNA) |
| Linux Linux | 4.4.218 | Vendor (CNA) |
| Linux Linux | 4.9.218 | Vendor (CNA) |
| Linux Linux | 5.4.29 | Vendor (CNA) |
| Linux Linux | 5.5.14 | Vendor (CNA) |
| Linux Linux | 557d015ffb27b672e24e6ad141fd887783871dc2 | Vendor (CNA) |
| Linux Linux | 9f8b6c44be178c2498a00b270872a6e30e7c8266 | Vendor (CNA) |
| Linux Linux | bd3ee8fb6371b45c71c9345cc359b94da2ddefa9 | Vendor (CNA) |
| Linux Linux | c4453d2833671e3a9f6bd52f0f581056c3736386 | Vendor (CNA) |
| Linux Linux | d23faf32e577922b6da20bf3740625c1105381bf | Vendor (CNA) |
| Linux Linux | d6cdc5bb19b595486fb2e6661e5138d73a57f454 | Vendor (CNA) |
| debian:linux | 5.5.17-1 · Debian:12 | Package registry (OSV) |
| suse:kernel-64kb | 5.3.18-150300.59.207.1 · SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | Package registry (OSV) |
| suse:kernel-default | 5.3.18-150300.59.207.1 · SUSE:Linux Enterprise Live Patching 15 SP3 | Package registry (OSV) |
| suse:kernel-default-base | 5.3.18-150300.59.207.1.150300.18.124.1 · SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | Package registry (OSV) |
| suse:kernel-docs | 5.3.18-150300.59.207.1 · SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | Package registry (OSV) |
| suse:kernel-livepatch-SLE15-SP3_Update_58 | 1-150300.7.3.1 · SUSE:Linux Enterprise Live Patching 15 SP3 | Package registry (OSV) |
| suse:kernel-obs-build | 5.3.18-150300.59.207.1 · SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | Package registry (OSV) |
| suse:kernel-preempt | 5.3.18-150300.59.207.1 · SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | Package registry (OSV) |
| suse:kernel-rt | 5.3.18-150300.211.1 · SUSE:Linux Enterprise Micro 5.1 | Package registry (OSV) |
| suse:kernel-source | 5.3.18-150300.59.207.1 · SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | Package registry (OSV) |
| suse:kernel-syms | 5.3.18-150300.59.207.1 · SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | Package registry (OSV) |
| suse:kernel-zfcpdump | 5.3.18-150300.59.207.1 · SUSE:Linux Enterprise Server 15 SP3-LTSS | Package registry (OSV) |
| suse:kgraft-patch-SLE12-SP5_Update_69 | 1-8.3.1 · SUSE:Linux Enterprise Live Patching 12 SP5 | Package registry (OSV) |
Exploit status
No known public exploit
No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.
Research context
For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.
Timeline
From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.
No dated events beyond publication.
Not on record for this CVE: EPSS history · patch commit or PR link · researcher credit · variant or chain candidate · public bounty program.
Technical details
Attack conditions
- Someone with local access to the system can trigger it.
- A low-privileged account is enough.
- No user action is required.
- No special conditions are required; it is repeatable.
If successful
- Confidentiality
- high · data can be read
- Integrity
- none
- Availability
- high · the service can be disrupted
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- High
- Integrity impact
- None
- Availability impact
- High
Weakness class (CWE)
CWE-125 · Out-of-bounds ReadCVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
nvd-primary
Attack context
MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.
Attack patterns (CAPEC)
ATT&CK techniques
—
Change log (1)
- Fix✗ → ✓
For records you follow, these changes also arrive as notifications. →
References
Show all references (8 more)Show less
- git.kernel.org/stable/c/0d1c3530e1bd38382edef72591b78e877e0edcd3
- git.kernel.org/stable/c/557d015ffb27b672e24e6ad141fd887783871dc2
- git.kernel.org/stable/c/9f8b6c44be178c2498a00b270872a6e30e7c8266
- git.kernel.org/stable/c/bd3ee8fb6371b45c71c9345cc359b94da2ddefa9
- git.kernel.org/stable/c/c4453d2833671e3a9f6bd52f0f581056c3736386
- git.kernel.org/stable/c/d23faf32e577922b6da20bf3740625c1105381bf
- git.kernel.org/stable/c/d6cdc5bb19b595486fb2e6661e5138d73a57f454
- syzkaller.appspot.com/bug?id=ea260693da894e7b078d18fca2c9c0a19b457534
Vendor advisories and official records. Exploit/PoC links are deliberately left out.