CVE-2020-8835: Canonical Ubuntu Linux

High severity, CVSS 7.8. EPSS: 6% chance of exploitation in the next 30 days.

In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)

Affected products

  • Canonical Ubuntu Linux: version 18.04 only; version 19.10 only
  • Fedoraproject Fedora: version 30 only; version 31 only; version 32 only
  • Linux Linux Kernel: from 5.4.7, before 5.4.29 (fixed in 5.4.29); from 5.5.0, before 5.5.14 (fixed in 5.5.14); from 5.6, before 5.6.1 (fixed in 5.6.1)
  • Netapp 8300 Firmware: affected versions not specified
  • Netapp 8700 Firmware: affected versions not specified
  • Netapp a220 Firmware: affected versions not specified
  • Netapp a320 Firmware: affected versions not specified
  • Netapp a400 Firmware: affected versions not specified
  • Netapp a700s Firmware: affected versions not specified
  • Netapp a800 Firmware: affected versions not specified
  • Netapp c190 Firmware: affected versions not specified
  • Netapp Cloud Backup: affected versions not specified
  • Netapp FAS2720 Firmware: affected versions not specified
  • Netapp FAS2750 Firmware: affected versions not specified
  • Netapp h300e Firmware: affected versions not specified
  • Netapp h300s Firmware: affected versions not specified
  • Netapp h410s Firmware: affected versions not specified
  • Netapp h500e Firmware: affected versions not specified
  • Netapp h500s Firmware: affected versions not specified
  • Netapp h610c Firmware: affected versions not specified
  • Netapp h610s Firmware: affected versions not specified
  • Netapp h615c Firmware: affected versions not specified
  • Netapp h700e Firmware: affected versions not specified
  • Netapp h700s Firmware: affected versions not specified
  • Netapp Hci Management Node: affected versions not specified
  • and 2 more

Published 2020-04-02. Last modified 2026-06-17.