Read the docs
TI-2020-08661 Aliases CVE-2020-10766GHSA-c87p-h49c-qjmw

A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD.

Priority LOW 25CWE-440Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality.

Why it matters now

EPSS 0.00463 40th percentileScored 2026-11-07
Fix Fixed kernel (Linux Kernel): 5.8-rc1Red Hat: 6 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Linuxkernelbefore 5.8-rc15.8-rc1Patch availableCNA
  • kernel VendorLinux Affected before 5.8-rc1 Fixed in 5.8-rc1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*before 5.8.0VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions before 5.8.0 Vulnerable ·Linux

Remediation

  • Fix · CNA kernel (Linux Kernel) Fixed in 5.8-rc1

Red Hat 6 advisories

  • RHSA-2020:3297 Released 2020-08-04 · Red Hat rating Important
    kpatch-patch security update
    • Red Hat Enterprise Linux BaseOS EUS (v. 8.1) kpatch-patch-4_18_0-147-1-16.el8, kpatch-patch-4_18_0-147_0_2-1-12.el8, kpatch-patch-4_18_0-147_0_3-1-12.el8 +5
  • RHSA-2020:3222 Released 2020-07-29 · Red Hat rating Important
    kernel security and bug fix update
    • Red Hat CodeReady Linux Builder EUS (v. 8.1) kernel-tools-libs-devel-4.18.0-147.24.2.el8_1
    • Red Hat Enterprise Linux BaseOS EUS (v. 8.1) bpftool-4.18.0-147.24.2.el8_1, kernel-4.18.0-147.24.2.el8_1, kernel-abi-whitelists-4.18.0-147.24.2.el8_1 +19
  • RHSA-2020:3073 Released 2020-07-21 · Red Hat rating Important
    kpatch-patch security update
    • Red Hat Enterprise Linux BaseOS (v. 8) kpatch-patch-4_18_0-193-1-5.el8, kpatch-patch-4_18_0-193_1_2-1-3.el8_2, kpatch-patch-4_18_0-193_6_3-1-2.el8_2
Show 3 more Red Hat advisories
  • RHSA-2020:3041 Released 2020-07-21 · Red Hat rating Important
    kernel security and bug fix update
    • Red Hat Enterprise Linux BaseOS E4S (v. 8.0) bpftool-4.18.0-80.27.1.el8_0, kernel-4.18.0-80.27.1.el8_0, kernel-abi-whitelists-4.18.0-80.27.1.el8_0 +14
  • RHSA-2020:3016 Released 2020-07-21 · Red Hat rating Important
    kernel-rt security and bug fix update
    • Red Hat Enterprise Linux Real Time (v. 8) kernel-rt-4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-core-4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-debug-4.18.0-193.13.2.rt13.65.el8_2 +7
    • Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt-4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-core-4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-debug-4.18.0-193.13.2.rt13.65.el8_2 +9
  • RHSA-2020:3010 Released 2020-07-21 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 8) kernel-tools-libs-devel-4.18.0-193.13.2.el8_2
    • Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-193.13.2.el8_2, kernel-4.18.0-193.13.2.el8_2, kernel-abi-whitelists-4.18.0-193.13.2.el8_2 +19

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2020:3010
Red Hat CodeReady Linux Builder EUS (v. 8.1)Fixed RHSA-2020:3222
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2020:3010, RHSA-2020:3073
Red Hat Enterprise Linux BaseOS E4S (v. 8.0)Fixed RHSA-2020:3041
Red Hat Enterprise Linux BaseOS EUS (v. 8.1)Fixed RHSA-2020:3222, RHSA-2020:3297
Red Hat Enterprise Linux Real Time (v. 8)Fixed RHSA-2020:3016
Red Hat Enterprise Linux Real Time for NFV (v. 8)Fixed RHSA-2020:3016
Not affected: 5 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.0)
  • Red Hat Enterprise MRG 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10766
  2. 2026-10-03 Alias added: GHSA-c87p-h49c-qjmw

References

Patch 1

Advisory 1

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences