CVE-2020-11668

HIGH

Linux Kernel < 5.6.1 - NULL Pointer Dereference

Title source: rule
STIX 2.1

Description

In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770.

References (12)

Core 12
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4345-1/
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4364-1/
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4368-1/
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4369-1/
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2020/dsa-4698
Vendor Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20200430-0004/
Mailing List mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
Mailing List mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html
Mailing List mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html

Scores

CVSS v3 7.1
EPSS 0.0005
EPSS Percentile 14.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Details

CWE
CWE-476
Status published
Products (1)
linux/linux_kernel < 5.6.1
Published Apr 09, 2020
Tracked Since Feb 18, 2026