Read the docs
TI-2020-15657 Aliases CVE-2020-25639GHSA-9h9r-mqj8-gh3f

NULL pointer dereference in kernel

Priority LOW 21CWE-476Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Deferred Red Hat: fix deferred

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. This flaw allows a local user to crash the system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00366 30th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—kernelLinux kernel versions prior to 5.12-rc1—No fix listedCNA
  • kernel Vendor— Affected Linux kernel versions prior to 5.12-rc1 Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*up to 5.11.2VulnerableLinux
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:a:redhat:openshift_container_platform:4.4:*:*:*:*:*:*:*4.4VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.5:*:*:*:*:*:*:*4.5VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.6:*:*:*:*:*:*:*4.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*5.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions up to 5.11.2 Vulnerable ·Linux
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:a:redhat:openshift_container_platform:4.4:*:*:*:*:*:*:* Versions 4.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.5:*:*:*:*:*:*:* Versions 4.5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:messaging_realtime_grid:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
  • cpe:2.3:o:redhat:messaging_realtime_grid:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Not affected: 5 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise MRG 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-25639
  2. 2026-10-03 Alias added: GHSA-9h9r-mqj8-gh3f
  3. 2026-10-08 CISA SSVC decision points changed

References

Exploit 1

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences