CVE-2020-10690 [Medium] | Use-After-Free in Linux Kernel

There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed, it can cause an exploitable condition as the process wakes up to terminate and clean all attached files. The system crashes due to the cdev structure being invalid (as already freed) which is pointed to by the inode.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.10%	0.36%	+0.26%
2	2025-11-04	0.02%	0.10%	+0.08%
3	2025-03-30	—	0.02%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.10%

0.36%

+0.26%

2025-11-04

0.02%

0.10%

+0.08%

2025-03-30

—

0.02%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
6.5	3.1	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:H) They need powerful rights—admin, root, or similar—before this pays off. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	0.6	5.9	[email protected]
6.4	3.1	MEDIUM	`CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:H) They need powerful rights—admin, root, or similar—before this pays off. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	0.5	5.9	[email protected]
4.4	2.0	MEDIUM	`AV:L/AC:M/Au:N/C:P/I:P/A:P` Click to expand Access vector (AV:L) Requires local access to the target system. Access complexity (AC:M) Exploitation needs some favorable conditions, but not exceptional ones. Authentication (AU:N) No authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:P) Partial availability impact.	3.4	6.4	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

6.5

3.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:H): They need powerful rights—admin, root, or similar—before this pays off.
User interaction (UI:R): A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

0.6

5.9

[email protected]

6.4

3.1

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:H): They need powerful rights—admin, root, or similar—before this pays off.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

0.5

5.9

[email protected]

4.4

2.0

MEDIUM

AV:L/AC:M/Au:N/C:P/I:P/A:P Click to expand

Access vector (AV:L): Requires local access to the target system.
Access complexity (AC:M): Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:P): Partial availability impact.

3.4

6.4

[email protected]

OS Trackers for CVE-2020-10690

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2020-10690 not yet assigned priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2020-10690
`redhat`	low	—	https://access.redhat.com/security/cve/CVE-2020-10690
`suse`	medium	CVE-2020-10690 severity moderate: SUSE including 623 source package names (amazon/suse-sles-15-sp1-chost-byos-v20210304-hvm-ssd-x86_64, amazon/suse-sles-15-sp1-chost-byos-v20220127-hvm-ssd-x86_64, …), 908 product×package rows across 113 product lines (HPE Helion OpenStack 8, Image SLES12-SP5-Azure-BYOS, … (113 product lines)): Fixed 742, Known Affected 157, Known Not Affected 9.	https://www.suse.com/security/cve/CVE-2020-10690/
`ubuntu`	medium	CVE-2020-10690 medium priority: Ubuntu including 112 source packages (linux, linux-aws, …), 1145 status rows across 12 suites (bionic, eoan, focal, groovy, jammy, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 813, not-affected 164, released 151, ignored 17.	https://ubuntu.com/security/CVE-2020-10690

Affected software / configurations for CVE-2020-10690

Vendor	Product	Version	Raw CPE
linux	linux_kernel	< 5.5	cpe:2.3:o:linux:linux_kernel::::::::
redhat	enterprise_linux	7.0	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
redhat	enterprise_linux	8.0	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
debian	debian_linux	8.0	cpe:2.3:o:debian:debian_linux:8.0:::::::*
canonical	ubuntu_linux	14.04	cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::
canonical	ubuntu_linux	16.04	cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::
opensuse	leap	15.1	cpe:2.3:o:opensuse:leap:15.1:::::::*
netapp	active_iq_unified_manager	—	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
netapp	element_software	—	cpe:2.3:a:netapp:element_software:-:::::::*
netapp	hci_management_node	—	cpe:2.3:a:netapp:hci_management_node:-:::::::*
netapp	solidfire	—	cpe:2.3:a:netapp:solidfire:-:::::::*
netapp	steelstore_cloud_integrated_storage	—	cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:::::::*
netapp	hci_compute_node	—	cpe:2.3:h:netapp:hci_compute_node:-:::::::*
netapp	h300s_firmware	—	cpe:2.3:o:netapp:h300s_firmware:-:::::::*
netapp	h500s_firmware	—	cpe:2.3:o:netapp:h500s_firmware:-:::::::*
netapp	h700s_firmware	—	cpe:2.3:o:netapp:h700s_firmware:-:::::::*
netapp	h300e_firmware	—	cpe:2.3:o:netapp:h300e_firmware:-:::::::*
netapp	h500e_firmware	—	cpe:2.3:o:netapp:h500e_firmware:-:::::::*
netapp	h700e_firmware	—	cpe:2.3:o:netapp:h700e_firmware:-:::::::*
netapp	h410s_firmware	—	cpe:2.3:o:netapp:h410s_firmware:-:::::::*
netapp	h410c_firmware	—	cpe:2.3:o:netapp:h410c_firmware:-:::::::*
netapp	h610c_firmware	—	cpe:2.3:o:netapp:h610c_firmware:-:::::::*
netapp	h610s_firmware	—	cpe:2.3:o:netapp:h610s_firmware:-:::::::*
netapp	h615c_firmware	—	cpe:2.3:o:netapp:h615c_firmware:-:::::::*

References for CVE-2020-10690

URL	Tags
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html	Mailing List Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10690	Issue Tracking Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html	Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20200608-0001/	Third Party Advisory
https://usn.ubuntu.com/4419-1/	Third Party Advisory

URL

CVE-2020-10690

Exploit prediction scoring system (EPSS) score for CVE-2020-10690

Common vulnerability scoring system (CVSS) metrics for CVE-2020-10690

Weakness enumeration for CVE-2020-10690

OS Trackers for CVE-2020-10690

Affected software / configurations for CVE-2020-10690

References for CVE-2020-10690