CVE-2020-36385

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10Release Notes, Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f5449e74802c1112dea984aec8af7a33c4516af1Patch, Vendor Advisory
https://security.netapp.com/advisory/ntap-20210720-0004/Third Party Advisory
https://sites.google.com/view/syzscope/kasan-use-after-free-read-in-ucma_close-2Patch, Third Party Advisory
https://syzkaller.appspot.com/bug?id=457491c4672d7b52c1007db213d93e47c711fae6Patch, Third Party Advisory
https://www.starwindsoftware.com/security/sw-20220802-0002/Third Party Advisory
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10Release Notes, Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f5449e74802c1112dea984aec8af7a33c4516af1Patch, Vendor Advisory
https://security.netapp.com/advisory/ntap-20210720-0004/Third Party Advisory
https://sites.google.com/view/syzscope/kasan-use-after-free-read-in-ucma_close-2Patch, Third Party Advisory
https://syzkaller.appspot.com/bug?id=457491c4672d7b52c1007db213d93e47c711fae6Patch, Third Party Advisory
https://www.starwindsoftware.com/security/sw-20220802-0002/Third Party Advisory

Timeline

Published: Jun 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-363867.1An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_re CVE-2020-363877.8An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_func and ctx reference CVE-2020-363888.8In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive.CVE-2020-363894.3In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.CVE-2020-36399.8u'When a non standard SIP sigcomp message is received from the network, then there may be chances of using more UDVM cycle or memory overflo CVE-2020-363947.0pam_setquota.c in the pam_setquota module before 2020-05-29 for Linux-PAM allows local attackers to set their quota on an arbitrary filesyst CVE-2020-363955.4A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to exec CVE-2020-363965.4A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to exe CVE-2020-363975.4A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers t CVE-2020-363985.4A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a CVE-2020-363995.4A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a CVE-2020-36407.8u'Resizing the usage table header before passing all the checks leads to the function exiting with a usage table in invalid state when a HLO