high 7.8

CVE-2020-10757 json

A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages.

published 2020-06-09 6y ago modified 2026-06-17 4mo ago also EUVD-2020-3174

cvss: 7.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits: 0; none known

A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system.

Patch / fix

fixed in 1 distros 5 links 2

linux linux_kernel 4.9.227, 4.14.184, 4.19.127, 5.4.45, 5.6.17, 5.7.1

debian ubuntu red hat suse opensuse

linux Debian 14, Debian 13, Debian 12 5.6.14-2

debian advisories DEBIAN-CVE-2020-10757

linux Ubuntu 18.04 LTS 4.15.0-112.113
linux Ubuntu 20.04 LTS 5.4.0-45.49
linux-aws Ubuntu 18.04 LTS 4.15.0-1079.83
linux-aws Ubuntu 20.04 LTS 5.4.0-1022.22
linux-gcp Ubuntu 16.04 LTS 4.15.0-1080.90~16.04.1
linux-gcp Ubuntu 20.04 LTS 5.4.0-1022.22
linux-hwe Ubuntu 16.04 LTS 4.15.0-112.113~16.04.1
linux-hwe Ubuntu 18.04 LTS 5.3.0-64.58~18.04.1

ubuntu advisories UBUNTU-CVE-2020-10757

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 7 3.10.0-1127.18.2.el7
perf RHEL 7 3.10.0-1127.18.2.el7
bpftool RHEL 7 3.10.0-1127.18.2.el7
python-perf RHEL 7 3.10.0-1127.18.2.el7
kernel-kdump RHEL 7 3.10.0-1127.18.2.el7
kernel-tools RHEL 7 3.10.0-1127.18.2.el7
kernel-tools-libs RHEL 7 3.10.0-1127.18.2.el7
kernel-bootwrapper RHEL 7 3.10.0-1127.18.2.el7

red hat advisories RHSA-2020:3220 RHSA-2020:3598 RHSA-2020:3222 RHSA-2020:3221 RHSA-2020:3226 RHSA-2020:3041

kernel-rt Real Time Module 15 SP1 4.12.14-14.28.1
kernel-syms-rt Real Time Module 15 SP1 4.12.14-14.28.1
kernel-rt_debug Real Time Module 15 SP1 4.12.14-14.28.1
kernel-source-rt Real Time Module 15 SP1 4.12.14-14.28.1
kernel-rt SLE Real Time 12 SP5 4.12.14-10.13.1
kernel-syms-rt SLE Real Time 12 SP5 4.12.14-10.13.1
kernel-rt_debug SLE Real Time 12 SP5 4.12.14-10.13.1
kernel-source-rt SLE Real Time 12 SP5 4.12.14-10.13.1

suse advisories SUSE-SU-2020:2508-1 SUSE-SU-2020:2487-1 SUSE-SU-2020:2478-1 SUSE-SU-2020:2156-1 SUSE-SU-2020:1784-1 SUSE-SU-2020:1781-1

kernel-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
kernel-syms-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
kernel-rt_debug openSUSE Leap 15.2 5.3.18-lp152.3.5.1
kernel-source-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
kernel-syms openSUSE Leap 15.1 4.12.14-lp151.28.52.1
kernel-obs-qa openSUSE Leap 15.1 4.12.14-lp151.28.52.3
kernel-source openSUSE Leap 15.1 4.12.14-lp151.28.52.1
kernel-default openSUSE Leap 15.1 4.12.14-lp151.28.52.1

opensuse advisories openSUSE-SU-2021:0242-1 openSUSE-SU-2020:0801-1

Is CVE-2020-10757 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-10757 updated 2026-11-04 cvss 7.0

kernel: kernel: DAX hugepages not considered during mremap

Red Hat Enterprise Linux 7 perf, kernel, kernel-alt, python-perf, kernel-kdump, kernel-tools, +3 more
affected: workaround, no fix available “Do not use DAX enabled storage.”
Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-193.13.2.el8_2, kernel-debuginfo-common-aarch64 4.18.0-193.13.2.el8_2, kernel-debuginfo-common-ppc64le 4.18.0-193.13.2.el8_2
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3010
Red Hat CodeReady Linux Builder EUS (v. 8.1) kernel-debuginfo-common-x86_64 4.18.0-147.24.2.el8_1, kernel-debuginfo-common-aarch64 4.18.0-147.24.2.el8_1, kernel-debuginfo-common-ppc64le 4.18.0-147.24.2.el8_1
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3222
Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-193.13.2.el8_2, kernel 4.18.0-193.13.2.el8_2, bpftool 4.18.0-193.13.2.el8_2, kernel-core 4.18.0-193.13.2.el8_2, kernel-tools 4.18.0-193.13.2.el8_2, python3-perf 4.18.0-193.13.2.el8_2, +15 more
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3010
Red Hat Enterprise Linux BaseOS E4S (v. 8.0) perf 4.18.0-80.27.1.el8_0, kernel 4.18.0-80.27.1.el8_0, bpftool 4.18.0-80.27.1.el8_0, kernel-core 4.18.0-80.27.1.el8_0, kernel-tools 4.18.0-80.27.1.el8_0, python3-perf 4.18.0-80.27.1.el8_0, +9 more
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3041
Red Hat Enterprise Linux BaseOS EUS (v. 8.1) perf 4.18.0-147.24.2.el8_1, kernel 4.18.0-147.24.2.el8_1, bpftool 4.18.0-147.24.2.el8_1, kernel-core 4.18.0-147.24.2.el8_1, kernel-tools 4.18.0-147.24.2.el8_1, python3-perf 4.18.0-147.24.2.el8_1, +15 more
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3222
Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-1127.18.2.el7, kernel 3.10.0-1127.18.2.el7, bpftool 3.10.0-1127.18.2.el7, python-perf 3.10.0-1127.18.2.el7, kernel-tools 3.10.0-1127.18.2.el7, kernel-tools-libs 3.10.0-1127.18.2.el7, +2 more Red Hat Enterprise Linux Client Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1127.18.2.el7 Red Hat Enterprise Linux ComputeNode (v. 7) perf 3.10.0-1127.18.2.el7, kernel 3.10.0-1127.18.2.el7, bpftool 3.10.0-1127.18.2.el7, python-perf 3.10.0-1127.18.2.el7, kernel-tools 3.10.0-1127.18.2.el7, kernel-tools-libs 3.10.0-1127.18.2.el7, +2 more
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3220
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) perf 3.10.0-957.58.2.el7, kernel 3.10.0-957.58.2.el7, bpftool 3.10.0-957.58.2.el7, python-perf 3.10.0-957.58.2.el7, kernel-tools 3.10.0-957.58.2.el7, kernel-tools-libs 3.10.0-957.58.2.el7, +2 more
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3226

show 16 more

Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) perf 3.10.0-1062.33.1.el7, kernel 3.10.0-1062.33.1.el7, bpftool 3.10.0-1062.33.1.el7, python-perf 3.10.0-1062.33.1.el7, kernel-tools 3.10.0-1062.33.1.el7, kernel-tools-libs 3.10.0-1062.33.1.el7, +2 more
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3598
Red Hat Enterprise Linux ComputeNode Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1127.18.2.el7
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3220
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) kernel-debuginfo-common-x86_64 3.10.0-957.58.2.el7
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3226
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) kernel-debuginfo-common-x86_64 3.10.0-1062.33.1.el7
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3598
Red Hat Enterprise Linux for Real Time for NFV (v. 7) kernel-rt 3.10.0-1127.18.2.rt56.1116.el7, kernel-rt-kvm 3.10.0-1127.18.2.rt56.1116.el7, kernel-rt-trace 3.10.0-1127.18.2.rt56.1116.el7, kernel-rt-debug-kvm 3.10.0-1127.18.2.rt56.1116.el7, kernel-rt-trace-kvm 3.10.0-1127.18.2.rt56.1116.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1127.18.2.rt56.1116.el7
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3221
Red Hat Enterprise Linux Real Time (v. 8) kernel-rt 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-core 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-modules 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-debug-core 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-debug-modules 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-modules-extra 4.18.0-193.13.2.rt13.65.el8_2, +2 more Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-kvm 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-core 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-modules 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-debug-kvm 4.18.0-193.13.2.rt13.65.el8_2, kernel-rt-debug-core 4.18.0-193.13.2.rt13.65.el8_2, +4 more
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3016
Red Hat Enterprise Linux Realtime (v. 7) kernel-rt 3.10.0-1127.18.2.rt56.1116.el7, kernel-rt-trace 3.10.0-1127.18.2.rt56.1116.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1127.18.2.rt56.1116.el7
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3221
Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-1127.18.2.el7, kernel 3.10.0-1127.18.2.el7, bpftool 3.10.0-1127.18.2.el7, python-perf 3.10.0-1127.18.2.el7, kernel-kdump 3.10.0-1127.18.2.el7, kernel-tools 3.10.0-1127.18.2.el7, +7 more
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3220
Red Hat Enterprise Linux Server EUS (v. 7.6) perf 3.10.0-957.58.2.el7, kernel 3.10.0-957.58.2.el7, bpftool 3.10.0-957.58.2.el7, python-perf 3.10.0-957.58.2.el7, kernel-kdump 3.10.0-957.58.2.el7, kernel-tools 3.10.0-957.58.2.el7, +7 more
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3226
Red Hat Enterprise Linux Server EUS (v. 7.7) perf 3.10.0-1062.33.1.el7, kernel 3.10.0-1062.33.1.el7, bpftool 3.10.0-1062.33.1.el7, python-perf 3.10.0-1062.33.1.el7, kernel-kdump 3.10.0-1062.33.1.el7, kernel-tools 3.10.0-1062.33.1.el7, +7 more
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3598
Red Hat Enterprise Linux Server Optional (v. 7) kernel-debuginfo-common-ppc64 3.10.0-1127.18.2.el7, kernel-debuginfo-common-x86_64 3.10.0-1127.18.2.el7, kernel-debuginfo-common-ppc64le 3.10.0-1127.18.2.el7
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3220
Red Hat Enterprise Linux Server Optional EUS (v. 7.6) kernel-debuginfo-common-ppc64 3.10.0-957.58.2.el7, kernel-debuginfo-common-x86_64 3.10.0-957.58.2.el7, kernel-debuginfo-common-ppc64le 3.10.0-957.58.2.el7
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3226
Red Hat Enterprise Linux Server Optional EUS (v. 7.7) kernel-debuginfo-common-ppc64 3.10.0-1062.33.1.el7, kernel-debuginfo-common-x86_64 3.10.0-1062.33.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-1062.33.1.el7
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3598
Red Hat Enterprise Linux Workstation (v. 7) perf 3.10.0-1127.18.2.el7, kernel 3.10.0-1127.18.2.el7, bpftool 3.10.0-1127.18.2.el7, python-perf 3.10.0-1127.18.2.el7, kernel-tools 3.10.0-1127.18.2.el7, kernel-tools-libs 3.10.0-1127.18.2.el7, +2 more Red Hat Enterprise Linux Workstation Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1127.18.2.el7
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3220
Red Hat Virtualization 4.2 Hypervisor for RHEL 7.6 EUS perf 3.10.0-957.58.2.el7, python-perf 3.10.0-957.58.2.el7
fixed: vendor fix “Do not use DAX enabled storage.” RHSA-2020:3226
Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux BaseOS E4S (v. 8.0) kernel-headers 4.18.0-80.27.1.el8_0, kernel-cross-headers 4.18.0-80.27.1.el8_0 Red Hat Enterprise MRG 2 kernel-rt, mrg-rt-release, kernel-rt-trace, kernel-rt-vanilla, kernel-rt-firmware
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.99% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

openwall.com https://www.openwall.com/lists/oss-security/2020/06/04/4 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.9	AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected products

n/a Kernel

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-843 Access of Resource Using Incompatible Type

Technology feeds

Linux kernel rss critical rss

References

git.kernel.org /pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5bfea2d9b17f1034a68147a8b03b9789af5700f9
patch, vendor-advisory
lists.opensuse.org /opensuse-security-announce/2020-06/msg00022.html
vendor-advisory, mailing-list, patch, third-party-advisory
openwall.com /lists/oss-security/2020/06/04/4
exploit, mailing-list, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=1842525
vendor-advisory, issue-tracking, third-party-advisory
debian.org /security/2020/dsa-4698
vendor-advisory, third-party-advisory
debian.org /security/2020/dsa-4699
vendor-advisory, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/IEM47BXZJLODRH5YNNZSAQ2NVM63MYMC/
vendor-advisory, third-party-advisory, vdb-entry
usn.ubuntu.com /4439-1/
vendor-advisory, third-party-advisory
usn.ubuntu.com /4426-1/
vendor-advisory, third-party-advisory, vdb-entry
usn.ubuntu.com /4440-1/
vendor-advisory, third-party-advisory, vdb-entry
usn.ubuntu.com /4483-1/
vendor-advisory, third-party-advisory, vdb-entry
lists.debian.org /debian-lts-announce/2020/06/msg00012.html
mailing-list, third-party-advisory
security.netapp.com /advisory/ntap-20200702-0004/
third-party-advisory

Sources

CVE List CVE-2020-10757
NVD CVE-2020-10757

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed