GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2020-36791 (GCVE-0-2020-36791)

Vulnerability from cvelistv5 – Published: 2025-05-07 13:17 – Updated: 2026-08-05 08:44
VLAI
Title
net_sched: keep alloc_hash updated after hash allocation
Summary
In the Linux kernel, the following vulnerability has been resolved: net_sched: keep alloc_hash updated after hash allocation In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") I moved cp->hash calculation before the first tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched. This difference could lead to another out of bound access. cp->alloc_hash should always be the size allocated, we should update it after this tcindex_alloc_perfect_hash().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 73c29d2f6f8ae731b1e09051b69ed3ba2319482b , < d6cdc5bb19b595486fb2e6661e5138d73a57f454 (git)
Affected: b974ac51f5834a729de252fc5c1c9de9efd79b45 , < c4453d2833671e3a9f6bd52f0f581056c3736386 (git)
Affected: 6cb448ee493c8a514c9afa0c346f3f5b3227de85 , < 9f8b6c44be178c2498a00b270872a6e30e7c8266 (git)
Affected: 478c4b2ffd44e5186c7e22ae7c38a86a5b9cfde5 , < 557d015ffb27b672e24e6ad141fd887783871dc2 (git)
Affected: dd8142a6fa5270783d415292ec8169f4ea2a5468 , < d23faf32e577922b6da20bf3740625c1105381bf (git)
Affected: 2c66ff8d08f81bcf8e8cb22e31e39c051b15336a , < bd3ee8fb6371b45c71c9345cc359b94da2ddefa9 (git)
Affected: 599be01ee567b61f4471ee8078870847d0a11e8e , < 0d1c3530e1bd38382edef72591b78e877e0edcd3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.4.214 , < 4.4.218 (semver)
Affected: 4.9.214 , < 4.9.218 (semver)
Affected: 4.14.171 , < 4.14.175 (semver)
Affected: 4.19.103 , < 4.19.114 (semver)
Affected: 5.4.19 , < 5.4.29 (semver)
Affected: 5.5.3 , < 5.5.14 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/cls_tcindex.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d6cdc5bb19b595486fb2e6661e5138d73a57f454",
              "status": "affected",
              "version": "73c29d2f6f8ae731b1e09051b69ed3ba2319482b",
              "versionType": "git"
            },
            {
              "lessThan": "c4453d2833671e3a9f6bd52f0f581056c3736386",
              "status": "affected",
              "version": "b974ac51f5834a729de252fc5c1c9de9efd79b45",
              "versionType": "git"
            },
            {
              "lessThan": "9f8b6c44be178c2498a00b270872a6e30e7c8266",
              "status": "affected",
              "version": "6cb448ee493c8a514c9afa0c346f3f5b3227de85",
              "versionType": "git"
            },
            {
              "lessThan": "557d015ffb27b672e24e6ad141fd887783871dc2",
              "status": "affected",
              "version": "478c4b2ffd44e5186c7e22ae7c38a86a5b9cfde5",
              "versionType": "git"
            },
            {
              "lessThan": "d23faf32e577922b6da20bf3740625c1105381bf",
              "status": "affected",
              "version": "dd8142a6fa5270783d415292ec8169f4ea2a5468",
              "versionType": "git"
            },
            {
              "lessThan": "bd3ee8fb6371b45c71c9345cc359b94da2ddefa9",
              "status": "affected",
              "version": "2c66ff8d08f81bcf8e8cb22e31e39c051b15336a",
              "versionType": "git"
            },
            {
              "lessThan": "0d1c3530e1bd38382edef72591b78e877e0edcd3",
              "status": "affected",
              "version": "599be01ee567b61f4471ee8078870847d0a11e8e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/cls_tcindex.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4.4.218",
              "status": "affected",
              "version": "4.4.214",
              "versionType": "semver"
            },
            {
              "lessThan": "4.9.218",
              "status": "affected",
              "version": "4.9.214",
              "versionType": "semver"
            },
            {
              "lessThan": "4.14.175",
              "status": "affected",
              "version": "4.14.171",
              "versionType": "semver"
            },
            {
              "lessThan": "4.19.114",
              "status": "affected",
              "version": "4.19.103",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.29",
              "status": "affected",
              "version": "5.4.19",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5.14",
              "status": "affected",
              "version": "5.5.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.218",
                  "versionStartIncluding": "4.4.214",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.218",
                  "versionStartIncluding": "4.9.214",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.175",
                  "versionStartIncluding": "4.14.171",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.114",
                  "versionStartIncluding": "4.19.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.29",
                  "versionStartIncluding": "5.4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.5.14",
                  "versionStartIncluding": "5.5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: keep alloc_hash updated after hash allocation\n\nIn commit 599be01ee567 (\"net_sched: fix an OOB access in cls_tcindex\")\nI moved cp-\u003ehash calculation before the first\ntcindex_alloc_perfect_hash(), but cp-\u003ealloc_hash is left untouched.\nThis difference could lead to another out of bound access.\n\ncp-\u003ealloc_hash should always be the size allocated, we should\nupdate it after this tcindex_alloc_perfect_hash()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered through the tc filter netlink configuration path (RTM_NEWTFILTER \u2192 tc_new_tfilter \u2192 tcindex_change \u2192 tcindex_set_parms), not by processing network packets. Exploitation requires local netlink/syscall access to configure cls_tcindex.\nAC:L - An attacker fully controls both the old and new hash sizes and the filter handle via netlink attributes, so shrinking a perfect hash while using a handle past the newly allocated size reliably produces the OOB access with no race or external conditions.\nPR:L - tc_new_tfilter requires CAP_NET_ADMIN checked with netlink_ns_capable against the network namespace\u0027s user_ns, which an unprivileged user can obtain via user namespaces (unshare -Urn) without real root in the init namespace.\nUI:N - The attacker creates and modifies their own tcindex filters in a network namespace they control; no victim action is required.\nS:U - Impact is confined to the host kernel privilege boundary (local memory corruption / privilege escalation) and does not cross VM, IOMMU, or other distinct security authorities.\nC:H - Stale alloc_hash allows OOB reads through tcindex_get/tcindex_lookup (perfect + handle beyond the allocated array), and the heap OOB can be leveraged for arbitrary kernel memory disclosure.\nI:H - tcindex_set_parms does r = cp-\u003eperfect + handle then writes result/exts into that slot; with handle past the newly allocated hash this is a controlled heap out-of-bounds write enabling memory corruption and control-flow hijacking.\nA:H - The out-of-bounds access was caught by syzbot as a kernel memory-safety failure and can produce oops/panic or heap corruption leading to a crash even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:44:33.087Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d6cdc5bb19b595486fb2e6661e5138d73a57f454"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4453d2833671e3a9f6bd52f0f581056c3736386"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f8b6c44be178c2498a00b270872a6e30e7c8266"
        },
        {
          "url": "https://git.kernel.org/stable/c/557d015ffb27b672e24e6ad141fd887783871dc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/d23faf32e577922b6da20bf3740625c1105381bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd3ee8fb6371b45c71c9345cc359b94da2ddefa9"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d1c3530e1bd38382edef72591b78e877e0edcd3"
        },
        {
          "url": "https://syzkaller.appspot.com/bug?id=ea260693da894e7b078d18fca2c9c0a19b457534"
        },
        {
          "url": "https://blog.cdthoughts.ch/2021/03/16/syzbot-bug.html"
        }
      ],
      "title": "net_sched: keep alloc_hash updated after hash allocation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2020-36791",
    "datePublished": "2025-05-07T13:17:33.882Z",
    "dateReserved": "2024-02-26T17:07:27.435Z",
    "dateUpdated": "2026-08-05T08:44:33.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-36791",
      "date": "2026-09-19",
      "epss": "0.00191",
      "percentile": "0.09024"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sched/cls_tcindex.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d6cdc5bb19b595486fb2e6661e5138d73a57f454",
                    "status": "affected",
                    "version": "73c29d2f6f8ae731b1e09051b69ed3ba2319482b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c4453d2833671e3a9f6bd52f0f581056c3736386",
                    "status": "affected",
                    "version": "b974ac51f5834a729de252fc5c1c9de9efd79b45",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9f8b6c44be178c2498a00b270872a6e30e7c8266",
                    "status": "affected",
                    "version": "6cb448ee493c8a514c9afa0c346f3f5b3227de85",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "557d015ffb27b672e24e6ad141fd887783871dc2",
                    "status": "affected",
                    "version": "478c4b2ffd44e5186c7e22ae7c38a86a5b9cfde5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d23faf32e577922b6da20bf3740625c1105381bf",
                    "status": "affected",
                    "version": "dd8142a6fa5270783d415292ec8169f4ea2a5468",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bd3ee8fb6371b45c71c9345cc359b94da2ddefa9",
                    "status": "affected",
                    "version": "2c66ff8d08f81bcf8e8cb22e31e39c051b15336a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0d1c3530e1bd38382edef72591b78e877e0edcd3",
                    "status": "affected",
                    "version": "599be01ee567b61f4471ee8078870847d0a11e8e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sched/cls_tcindex.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4.4.218",
                    "status": "affected",
                    "version": "4.4.214",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.9.218",
                    "status": "affected",
                    "version": "4.9.214",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.14.175",
                    "status": "affected",
                    "version": "4.14.171",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.19.114",
                    "status": "affected",
                    "version": "4.19.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.4.29",
                    "status": "affected",
                    "version": "5.4.19",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.5.14",
                    "status": "affected",
                    "version": "5.5.3",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EA46E804-CC77-4E3E-8EFE-1E0D208F2891",
                    "versionEndExcluding": "4.4.218",
                    "versionStartIncluding": "4.4.214",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "532BFC53-5843-4E9A-9AB3-3898853DD42C",
                    "versionEndExcluding": "4.9.218",
                    "versionStartIncluding": "4.9.214",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26CFC34C-0C30-400B-A805-EBB9AD56155E",
                    "versionEndExcluding": "4.14.175",
                    "versionStartIncluding": "4.14.171",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "05AC3490-6BEC-4FB4-9577-02840D73CE90",
                    "versionEndExcluding": "4.19.114",
                    "versionStartIncluding": "4.19.103",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9253035D-B349-4044-B4B2-0052B6F8AF01",
                    "versionEndExcluding": "5.4.29",
                    "versionStartIncluding": "5.4.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AF089097-DB58-4F52-AC68-3418ADEE10A2",
                    "versionEndExcluding": "5.5.14",
                    "versionStartIncluding": "5.5.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.6:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "F5DAF39E-0835-49B4-8221-7FCE81692A4B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.6:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "73DFCE15-1BB8-4740-B9CD-57F2DF3EA15D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.6:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "7D3107F6-EB44-4C65-AA1B-1E96923F6409",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.6:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "DC0C894E-6323-44E5-89DD-8FB6A5C41CAF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.6:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "4C76EAC9-C2E6-4B6F-B002-ADBE74DDD794",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.6:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "F13B8FBF-E007-4F60-A290-2833B45F8520",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.6:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "CD0276C4-2C60-4C52-AC89-F96DF991B858",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: keep alloc_hash updated after hash allocation\n\nIn commit 599be01ee567 (\"net_sched: fix an OOB access in cls_tcindex\")\nI moved cp-\u003ehash calculation before the first\ntcindex_alloc_perfect_hash(), but cp-\u003ealloc_hash is left untouched.\nThis difference could lead to another out of bound access.\n\ncp-\u003ealloc_hash should always be the size allocated, we should\nupdate it after this tcindex_alloc_perfect_hash()."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net_sched: mantener alloc_hash actualizado tras la asignaci\u00f3n de hash. En el commit 599be01ee567 (\"net_sched: corregir un acceso OOB en cls_tcindex\"), se movi\u00f3 el c\u00e1lculo de cp-\u0026gt;hash antes del primer tcindex_alloc_perfect_hash(), pero se mantuvo intacto. Esta diferencia podr\u00eda provocar otro acceso fuera de los l\u00edmites. cp-\u0026gt;alloc_hash siempre debe tener el tama\u00f1o asignado; debemos actualizarlo despu\u00e9s de este tcindex_alloc_perfect_hash()."
          }
        ],
        "id": "CVE-2020-36791",
        "lastModified": "2026-08-04T10:16:35.580",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-05-07T14:15:28.513",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://blog.cdthoughts.ch/2021/03/16/syzbot-bug.html"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0d1c3530e1bd38382edef72591b78e877e0edcd3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/557d015ffb27b672e24e6ad141fd887783871dc2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9f8b6c44be178c2498a00b270872a6e30e7c8266"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bd3ee8fb6371b45c71c9345cc359b94da2ddefa9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c4453d2833671e3a9f6bd52f0f581056c3736386"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d23faf32e577922b6da20bf3740625c1105381bf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d6cdc5bb19b595486fb2e6661e5138d73a57f454"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Issue Tracking"
            ],
            "url": "https://syzkaller.appspot.com/bug?id=ea260693da894e7b078d18fca2c9c0a19b457534"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T10:33:08+00:00",
      "cve": "CVE-2020-36791",
      "id": "CVE-2020-36791",
      "initial_release_date": "2020-01-01T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net_sched: keep alloc_hash updated after hash allocation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-36791.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-13T00:04:45Z",
      "cve": "CVE-2020-36791",
      "id": "CVE-2020-36791",
      "initial_release_date": "2025-05-09T05:08:21Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "422",
      "product_status:recommended": "102",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2020-36791",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2020-36791.json",
      "version": "27"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.