CVE-2020-36791: linux kernel Out-of-bounds Read — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: net_sched: keep alloc_hash updated after hash allocation In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") I moved cp->hash calculation before the first tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched. This difference could lead to another out of bound access. cp->alloc_hash should always be the size allocated, we should update it after this tcindex_alloc_perfect_hash().

Is your site exposed to CVE-2020-36791?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.1

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness Type (CWE)

CWE-125 Out-of-bounds Read

Affected Products

Vendor	Product	Versions
linux	linux_kernel	4.4.214 — 4.4.218
linux	linux_kernel	4.9.214 — 4.9.218
linux	linux_kernel	4.14.171 — 4.14.175
linux	linux_kernel	4.19.103 — 4.19.114
linux	linux_kernel	5.4.19 — 5.4.29
linux	linux_kernel	5.5.3 — 5.5.14
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All

References

Advisories & Patches

https://git.kernel.org/stable/c/0d1c3530e1bd38382edef72591b78e877e0edcd3 https://git.kernel.org/stable/c/557d015ffb27b672e24e6ad141fd887783871dc2 https://git.kernel.org/stable/c/9f8b6c44be178c2498a00b270872a6e30e7c8266 https://git.kernel.org/stable/c/bd3ee8fb6371b45c71c9345cc359b94da2ddefa9 https://git.kernel.org/stable/c/c4453d2833671e3a9f6bd52f0f581056c3736386 https://git.kernel.org/stable/c/d23faf32e577922b6da20bf3740625c1105381bf https://git.kernel.org/stable/c/d6cdc5bb19b595486fb2e6661e5138d73a57f454

Other References

https://blog.cdthoughts.ch/2021/03/16/syzbot-bug.html https://syzkaller.appspot.com/bug?id=ea260693da894e7b078d18fca2c9c0a19b457534

Frequently Asked Questions

What is CVE-2020-36791? +

In the Linux kernel, the following vulnerability has been resolved: net_sched: keep alloc_hash updated after hash allocation In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") I moved cp->hash calculation before the first tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched. This difference could lead to another out of bound access. cp->alloc_hash should always be the size allocated, we should update it after this tcindex_alloc_perfect_hash(). It has a CVSS v3.1 base score of 7.1 (HIGH).

How severe is CVE-2020-36791? +

CVE-2020-36791 has a CVSS v3.1 score of 7.1 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2020-36791? +

CVE-2020-36791 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2020-36791? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-29013

libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cbor.c relies solely on assert() …

CVE-2026-53566

Out-of-bounds read vulnerability in Citrix Citrix Secure Access Client for Windows. This issue affects Citrix Secure Access Client for Windows: …

CVE-2026-3508

An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system …

CVE-2026-57073

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings …

CVE-2026-57074

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings …

CVE-2026-57075

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec. The base64 decoder …

CVE-2020-36791