CVE-2020-12652: linux linux_kernel
Vulnerability summary
CVE-2020-12652 is a medium (CVSS 4.7) vulnerability in linux linux_kernel. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 25.9% of scored vulnerabilities.
Not severe (CVSS 4.1, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 19 · Related 16Timeline
- 05-05-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The __mptctl_ioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to hold an incorrect lock during the ioctl operation and trigger a race condition, i.e., a "double fetch" vulnerability, aka CID-28d76df18f0a. NOTE: the vendor states "The security impact of this bug is not as bad as it could have been because these operations are all privileged and root already has enormous destructive power."
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · DebianEcosystem advisory · calculated4.1MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
- NVDNIST4.1MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.33% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu35 products
- linuxAll versions (No fix recorded) | < 4.4.0-174.204 | < 4.15.0-91.92
- linux-aws< 4.4.0-1062.66 | < 4.4.0-1102.113 | < 4.15.0-1063.67
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-fips< 4.15.0-2018.18 | All versions (No fix recorded)
- linux-aws-hwe< 4.15.0-1063.67~16.04.1
Debian1 product
- linux< 5.4.19-1
Linux1 product
- linux_kernel< 5.4.14
3 vendors · 37 products
References
13 links- cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.14X Refsource MISCREPORTRelease NotesVendor Advisory
- github.com/torvalds/linux/commit/28d76df18f0ad5bcf5fa48510b225f0ed262a99bX Refsource MISCREPORTPatchThird Party Advisory
- security.netapp.com/advisory/ntap-20200608-0001/X Refsource CONFIRM
