CVE-2020-12769: canonical ubuntu_linux Improper Synchronization

Modified

AliasesUBUNTU-CVE-2020-12769DEBIAN-CVE-2020-12769

Published 09-05-2020Last modified 08-10-2026

Vulnerability summary

CVE-2020-12769 is a medium (CVSS 5.5) Improper Synchronization vulnerability in canonical ubuntu_linux. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 51.3% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.5/10

010

Medium · v3.1 (NVD)

EPSS score

0.65%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 18 · Related 16

DLA-2241-1 LSN-0069-1 OPENSUSE-SU-2020:0801-1 OPENSUSE-SU-2020:0935-1 OPENSUSE-SU-2021:0242-1 SUSE-SU-2020:1587-1+12 more

Timeline

09-05-2020
PublishedVulnerability first disclosed.
08-10-2026
Last modifiedVulnerability information updated.

Description

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one, aka CID-19b61392c5a8.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.15.5v2.04.9

EPSS trend

Probability

0.65%

Chance of exploitation in the next 30 days

Percentile

51%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.65% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (lkml.org)
Maturity: unknown
referenceUnverified
Exploit Reference (git.kernel.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-662Improper SynchronizationThe product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu35 products

linuxAll versions (No fix recorded) | < 4.4.0-184.214 | < 4.15.0-96.97
linux-aws< 4.4.0-1073.77 | < 4.4.0-1109.120 | < 4.15.0-1065.69
linux-aws-5.0All versions (No fix recorded)
linux-aws-fips< 4.15.0-2018.18 | All versions (No fix recorded)
linux-aws-hwe< 4.15.0-1065.69~16.04.1

Show all 35

Netapp19 products

Show all 19

Debian2 products

linux< 5.4.19-1
debian_linuxEOL8.0

Canonical1 product

ubuntu_linuxEOL14.04 | 16.04

Linux1 product

linux_kernel< 5.4.17

Opensuse1 product

leapEOL15.1 | 15.2

6 vendors · 59 products

References

14 links

lkml.org/lkml/2020/2/3/559X Refsource CONFIRMREPORTExploitMailing ListPatchTechnical Description
git.kernel.org/pub/…X Refsource CONFIRMREPORTExploitMailing ListPatchVendor Advisory
cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.17X Refsource CONFIRMREPORTMailing ListPatchVendor Advisory
security.netapp.com/advisory/ntap-20200608-0001/X Refsource CONFIRMThird Party Advisory
lists.debian.org/debian-lts-announce/2020/06/msg00011.htmlMailing ListX Refsource MLISTThird Party Advisory
lists.debian.org/debian-lts-announce/2020/06/msg00013.htmlMailing ListX Refsource MLISTThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
usn.ubuntu.com/4391-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
ubuntu.com/security/CVE-2020-12769REPORT

Show all 14 references