CVE-2020-36791

net_sched: keep alloc_hash updated after hash allocation

State: Published
Severity: 7.8 High
Published: May 7, 2025
Updated: Aug 5, 2026
Reserved: Feb 26, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net_sched: keep alloc_hash updated after hash allocation

In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") I moved cp->hash calculation before the first tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched. This difference could lead to another out of bound access.

cp->alloc_hash should always be the size allocated, we should update it after this tcindex_alloc_perfect_hash().

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	73c29d2f6f8ae731b1e09051b69ed3ba2319482b to before d6cdc5bb19b595486fb2e6661e5138d73a57f454Affected b974ac51f5834a729de252fc5c1c9de9efd79b45 to before c4453d2833671e3a9f6bd52f0f581056c3736386Affected 6cb448ee493c8a514c9afa0c346f3f5b3227de85 to before 9f8b6c44be178c2498a00b270872a6e30e7c8266Affected 478c4b2ffd44e5186c7e22ae7c38a86a5b9cfde5 to before 557d015ffb27b672e24e6ad141fd887783871dc2Affected dd8142a6fa5270783d415292ec8169f4ea2a5468 to before d23faf32e577922b6da20bf3740625c1105381bfAffected 2c66ff8d08f81bcf8e8cb22e31e39c051b15336a to before bd3ee8fb6371b45c71c9345cc359b94da2ddefa9Affected 599be01ee567b61f4471ee8078870847d0a11e8e to before 0d1c3530e1bd38382edef72591b78e877e0edcd3Affected
LinuxLinux	4.4.214 to before 4.4.218Affected 4.9.214 to before 4.9.218Affected 4.14.171 to before 4.14.175Affected 4.19.103 to before 4.19.114Affected 5.4.19 to before 5.4.29Affected 5.5.3 to before 5.5.14Affected

Product

Versions

LinuxLinux

73c29d2f6f8ae731b1e09051b69ed3ba2319482b to before d6cdc5bb19b595486fb2e6661e5138d73a57f454Affected
b974ac51f5834a729de252fc5c1c9de9efd79b45 to before c4453d2833671e3a9f6bd52f0f581056c3736386Affected
6cb448ee493c8a514c9afa0c346f3f5b3227de85 to before 9f8b6c44be178c2498a00b270872a6e30e7c8266Affected
478c4b2ffd44e5186c7e22ae7c38a86a5b9cfde5 to before 557d015ffb27b672e24e6ad141fd887783871dc2Affected
dd8142a6fa5270783d415292ec8169f4ea2a5468 to before d23faf32e577922b6da20bf3740625c1105381bfAffected
2c66ff8d08f81bcf8e8cb22e31e39c051b15336a to before bd3ee8fb6371b45c71c9345cc359b94da2ddefa9Affected
599be01ee567b61f4471ee8078870847d0a11e8e to before 0d1c3530e1bd38382edef72591b78e877e0edcd3Affected

LinuxLinux

4.4.214 to before 4.4.218Affected
4.9.214 to before 4.9.218Affected
4.14.171 to before 4.14.175Affected
4.19.103 to before 4.19.114Affected
5.4.19 to before 5.4.29Affected
5.5.3 to before 5.5.14Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.