medium 5.5

CVE-2020-10768 json

A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation aft…

published 2020-09-15 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-3183

cvss: 5.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits: 0; none known

A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.

Patch / fix

fixed in 1 distros 5 links 1

linux linux_kernel 5.8.0

debian ubuntu red hat suse opensuse

linux Debian 14, Debian 13, Debian 12 5.7.6-1

debian advisories DEBIAN-CVE-2020-10768

linux Ubuntu 16.04 LTS 4.4.0-186.216
linux Ubuntu 18.04 LTS 4.15.0-115.116
linux Ubuntu 20.04 LTS 5.4.0-45.49
linux-aws Ubuntu 16.04 LTS 4.4.0-1111.123
linux-aws Ubuntu 18.04 LTS 4.15.0-1080.84
linux-aws Ubuntu 20.04 LTS 5.4.0-1022.22
linux-gcp Ubuntu 16.04 LTS 4.15.0-1081.92~16.04.1
linux-gcp Ubuntu 20.04 LTS 5.4.0-1022.22

ubuntu advisories UBUNTU-CVE-2020-10768

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kpatch-patch-4_18_0-193 RHEL 8 1-5.el8
kpatch-patch-4_18_0-193_1_2 RHEL 8 1-3.el8_2
kpatch-patch-4_18_0-193_6_3 RHEL 8 1-2.el8_2
kernel-rt RHEL 8 4.18.0-193.13.2.rt13.65.el8_2
kernel-rt-kvm RHEL 8 4.18.0-193.13.2.rt13.65.el8_2
kernel-rt-core RHEL 8 4.18.0-193.13.2.rt13.65.el8_2
kernel-rt-modules RHEL 8 4.18.0-193.13.2.rt13.65.el8_2
kernel-rt-debug-kvm RHEL 8 4.18.0-193.13.2.rt13.65.el8_2

red hat advisories RHSA-2020:3222 RHSA-2020:3297 RHSA-2020:3073 RHSA-2020:3041 RHSA-2020:3016 RHSA-2020:3010

kernel-rt Real Time Module 15 SP1 4.12.14-14.28.1
kernel-syms-rt Real Time Module 15 SP1 4.12.14-14.28.1
kernel-rt_debug Real Time Module 15 SP1 4.12.14-14.28.1
kernel-source-rt Real Time Module 15 SP1 4.12.14-14.28.1
kernel-rt SLE Real Time 12 SP5 4.12.14-10.13.1
kernel-syms-rt SLE Real Time 12 SP5 4.12.14-10.13.1
kernel-rt_debug SLE Real Time 12 SP5 4.12.14-10.13.1
kernel-source-rt SLE Real Time 12 SP5 4.12.14-10.13.1

suse advisories SUSE-SU-2020:2487-1 SUSE-SU-2020:2478-1 SUSE-SU-2020:2156-1 SUSE-SU-2020:2134-1 SUSE-SU-2020:2121-1 SUSE-SU-2020:2107-1

kernel-source openSUSE Tumbleweed 5.14.6-1.4
kernel-source openSUSE Tumbleweed 6.6.17-1.1
kernel-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
kernel-syms-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
kernel-rt_debug openSUSE Leap 15.2 5.3.18-lp152.3.5.1
kernel-source-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
kernel-syms openSUSE Leap 15.1 4.12.14-lp151.28.59.1
kernel-obs-qa openSUSE Leap 15.1 4.12.14-lp151.28.59.1

opensuse advisories openSUSE-SU-2024:10728-1 openSUSE-SU-2024:13704-1 openSUSE-SU-2021:0242-1 openSUSE-SU-2020:1153-1 openSUSE-SU-2020:0935-1

git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4d8… commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-10768 updated 2026-11-04 cvss 5.5

kernel: Indirect branch speculation can be enabled after it was force-disabled by the PR_SPEC_FORCE_DISABLE prctl command.

Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-193.13.2.el8_2, kernel-debuginfo-common-aarch64 4.18.0-193.13.2.el8_2, kernel-debuginfo-common-ppc64le 4.18.0-193.13.2.el8_2
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3010
Red Hat CodeReady Linux Builder EUS (v. 8.1) kernel-debuginfo-common-x86_64 4.18.0-147.24.2.el8_1, kernel-debuginfo-common-aarch64 4.18.0-147.24.2.el8_1, kernel-debuginfo-common-ppc64le 4.18.0-147.24.2.el8_1
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3222
Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-193.13.2.el8_2, kernel 4.18.0-193.13.2.el8_2, bpftool 4.18.0-193.13.2.el8_2, kpatch-patch-4_18_0-193 1-5.el8, kernel-core 4.18.0-193.13.2.el8_2, kernel-tools 4.18.0-193.13.2.el8_2, +18 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3010
Red Hat Enterprise Linux BaseOS E4S (v. 8.0) perf 4.18.0-80.27.1.el8_0, kernel 4.18.0-80.27.1.el8_0, bpftool 4.18.0-80.27.1.el8_0, kernel-core 4.18.0-80.27.1.el8_0, kernel-tools 4.18.0-80.27.1.el8_0, python3-perf 4.18.0-80.27.1.el8_0, +9 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3041
Red Hat Enterprise Linux BaseOS EUS (v. 8.1) perf 4.18.0-147.24.2.el8_1, kernel 4.18.0-147.24.2.el8_1, bpftool 4.18.0-147.24.2.el8_1, kpatch-patch-4_18_0-147 1-16.el8, kernel-core 4.18.0-147.24.2.el8_1, kernel-tools 4.18.0-147.24.2.el8_1, +23 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3222
Red Hat Enterprise Linux Real Time (v. 8) kernel-rt 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-core 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-modules 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-debug-core 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-debug-modules 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-modules-extra 4.18.0-193.13.2.rt13.65.el8_2, +2 more Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-kvm 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-core 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-modules 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-debug-kvm 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-debug-core 4.18.0-193.13.2.rt13.65.el8_2, +4 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3016
Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, kernel-alt, python-perf, +9 more Red Hat Enterprise Linux BaseOS E4S (v. 8.0) kernel-headers 4.18.0-80.27.1.el8_0, kernel-cross-headers 4.18.0-80.27.1.el8_0 Red Hat Enterprise MRG 2 kernel-rt, mrg-rt-release, kernel-rt-trace, kernel-rt-vanilla, kernel-rt-firmware
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-074-07 updated 2024-03-14 cvss 5.5

Siemens SIMATIC

Siemens SIMATIC RF160B (6GT2003-0FA00) <V2.2
affected: mitigation “Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.” siemens.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

Linux Kernel kernel

Classification

Weakness

CWE-440 Expected Behavior Violation

Technology feeds

Linux kernel rss critical rss

References

git.kernel.org /pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4d8df8cbb9156b0a0ab3f802b80cb5db57acc0bf
patch, vendor-advisory
bugzilla.redhat.com /show_bug.cgi?id=CVE-2020-10768
issue-tracking, third-party-advisory

Sources

CVE List CVE-2020-10768
NVD CVE-2020-10768

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary