Skip to content
Fencer Vulns
high 7.8

CVE-2020-8835 json

Linux kernel bpf verifier vulnerability

published 2020-04-02 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-29678

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
6.0%
EPSS 6.0% chance of exploitation in 30 days, percentile 93%
public exploits
1
Metasploit

Summary

In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)

Patch / fix

  • Linux kernel Linux kernel 5.4.29, 5.5.14, 5.6.1
  • linux Debian 14, Debian 13, Debian 12 5.5.13-2

debian advisories DEBIAN-CVE-2020-8835

  • linux-hwe Ubuntu 18.04 LTS 5.3.0-45.37~18.04.1
  • linux-gcp-5.3 Ubuntu 18.04 LTS 5.3.0-1016.17~18.04.1
  • linux-gke-5.3 Ubuntu 18.04 LTS 5.3.0-1016.17~18.04.1
  • linux-azure-5.3 Ubuntu 18.04 LTS 5.3.0-1018.19~18.04.1
  • linux-oracle-5.3 Ubuntu 18.04 LTS 5.3.0-1013.14~18.04.1
  • linux-raspi2-5.3 Ubuntu 18.04 LTS 5.3.0-1021.23~18.04.1

ubuntu advisories UBUNTU-CVE-2020-8835

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • linux-hardened Arch Linux 5.5.13.b-1
  • linux-lts Arch Linux 5.4.28-2
  • linux Arch Linux 5.5.13.arch2-1

arch linux advisories AVG-1120AVG-1121AVG-1122

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-8835 updated cvss 7.0

kernel: out-of-bounds read/write in the bpf verifier

  • Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, kernel-alt, python-perf, +9 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise MRG 2 kernel-rt, mrg-rt-release, kernel-rt-trace, kernel-rt-vanilla, kernel-rt-firmware
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (Metasploit exploit/linux/local/cve_2021_3490_ebpf_alu32_bounds_check_lpe)

Exploit prediction

6.01% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Linux kernel Linux kernel

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.