CVE-2020-12464: Linux Kernel

Medium severity, CVSS 6.7. EPSS: 0.8% chance of exploitation in the next 30 days.

usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer occurs without a reference, aka CID-056ad39ee925.

Affected products

• Linux Linux Kernel: before 3.16.85 (fixed in 3.16.85); from 3.17, before 4.4.221 (fixed in 4.4.221); from 4.5, before 4.9.221 (fixed in 4.9.221); from 4.10, before 4.14.178 (fixed in 4.14.178); from 4.15, before 4.19.119 (fixed in 4.19.119); from 4.20, before 5.4.36 (fixed in 5.4.36); …
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Aff a700s: affected versions not specified
• Netapp Cloud Backup: affected versions not specified
• Netapp Hci Baseboard Management Controller: version h300s only; version h410c only; version h410s only; version h500s only; version h610c only; version h610s only; …
• Netapp Hci Compute Node: affected versions not specified
• Netapp Hci Storage Nodes: affected versions not specified
• Netapp Solidfire & Hci Storage Node: affected versions not specified
• Netapp Solidfire Baseboard Management Controller: affected versions not specified
• Netapp Steelstore Cloud Integrated Storage: affected versions not specified

Published 2020-04-29. Last modified 2026-06-17.