Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-29661

28
FAUCET Score

CVE-2020-29661 is a high-severity use-after-free vulnerability in the Linux kernel's tty subsystem (drivers/tty/tty_jobctrl.c), affecting versions through 5.9.13, including distributions like Debian, Fedora, and Oracle. This flaw, triggered by a locking issue with TIOCSPGRP, allows a local attacker to achieve high confidentiality, integrity, and availability impacts. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
>= 2.6.26, < 4.4.248CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 4.5, < 4.9.248CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 4.10, < 4.14.212CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 4.15, < 4.19.163CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 4.20, < 5.4.83CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.8HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.13%
Probability of exploitation in next 30 days
EPSS Percentile
63.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0113 is in the 93rd percentile among its peer group of 17,061 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (29)

microsoftpatch availablevia msrc
Product: cm1 kernel 5.4.91-1 on CBL Mariner 1.0Fixed in: 5.4.91-1
microsoftpatch availablevia msrc
Product: 19137-16820Fixed in: 5.4.91-1
oraclepatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6 Extended Lifecycle SupportFixed in: kernel-0:2.6.32-754.39.1.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: kernel-rt-0:3.10.0-1160.21.1.rt56.1158.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: kernel-alt-0:4.14.0-115.35.1.el7a
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: kernel-0:3.10.0-1160.21.1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: kpatch-patch
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.4 Advanced Update SupportFixed in: kernel-0:3.10.0-693.87.1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.4 Telco Extended Update SupportFixed in: kernel-0:3.10.0-693.87.1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.4 Update Services for SAP SolutionsFixed in: kernel-0:3.10.0-693.87.1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.6 Extended Update SupportFixed in: kernel-0:3.10.0-957.70.1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.6 Extended Update SupportFixed in: kpatch-patch
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.7 Extended Update SupportFixed in: kernel-0:3.10.0-1062.46.1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.7 Extended Update SupportFixed in: kpatch-patch
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: kernel-rt-0:4.18.0-240.15.1.rt7.69.el8_3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: kernel-0:4.18.0-240.15.1.el8_3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.1 Extended Update SupportFixed in: kernel-0:4.18.0-147.43.1.el8_1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.1 Extended Update SupportFixed in: kpatch-patch
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Extended Update SupportFixed in: kernel-rt-0:4.18.0-193.46.1.rt13.96.el8_2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Extended Update SupportFixed in: kpatch-patch
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Extended Update SupportFixed in: kernel-0:4.18.0-193.46.1.el8_2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Virtualization 4.2 for Red Hat Enterprise Linux 7.6 EUSFixed in: kernel-0:3.10.0-957.70.1.el7
View patch
capnprotovendor investigatingvia llm_extracted
gcpvendor investigatingvia llm_extracted
hanwhavendor investigatingvia llm_extracted
kongvendor investigatingvia llm_extracted
openwrtvendor investigatingvia llm_extracted
proxmoxvendor investigatingvia llm_extracted

Vendor Advisories (14)

gcpllm-gcp-01a119d0ea3516faCRITICAL

ctrlX Multiple Vulnerabilities

Apr 23, 2021
proxmoxllm-proxmox-202933dd58ce3ba3CRITICAL

ctrlX Multiple Vulnerabilities

Apr 23, 2021
kongllm-kong-7933c1edf7557da9CRITICAL

ctrlX Multiple Vulnerabilities

Apr 23, 2021
openwrtllm-openwrt-b814c0e383a6a281CRITICAL

ctrlX Multiple Vulnerabilities

Apr 23, 2021
hanwhallm-hanwha-0b610f8bff10f748CRITICAL

ctrlX Multiple Vulnerabilities

Apr 23, 2021
capnprotollm-capnproto-5feb06313b602a85HIGH

ctrlX Multiple Vulnerabilities

Apr 23, 2021
proxmoxllm-proxmox-77597c349f5a62b7HIGH

Privilege Escalation via sudo and Linux kernel in Bosch Rexroth Products

Feb 24, 2021
capnprotollm-capnproto-9588a8ce023d2b33HIGH

Privilege Escalation via sudo and Linux kernel in Bosch Rexroth Products

Feb 24, 2021
openwrtllm-openwrt-064da59f8b3f9ed5HIGH

Privilege Escalation via sudo and Linux kernel in Bosch Rexroth Products

Feb 24, 2021
gcpllm-gcp-f281891ce77835ceHIGH

Privilege Escalation via sudo and Linux kernel in Bosch Rexroth Products

Feb 24, 2021
kongllm-kong-0e7035995c92cb05HIGH

Privilege Escalation via sudo and Linux kernel in Bosch Rexroth Products

Feb 24, 2021
hanwhallm-hanwha-52bcc742b4b25d7cHIGH

Privilege Escalation via sudo and Linux kernel in Bosch Rexroth Products

Feb 24, 2021
microsoft2020-Dec/CVE-2020-29661Important

A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP aka CID-54ffccbf053b.

Dec 8, 2020
redhatCVE-2020-29661Important

kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free

Dec 4, 2020

References

packetstormsecurity.com / files/160681/Linux-TIOCSPGRP-Broken-Locking.html
Third Party AdvisoryVDB Entry
packetstormsecurity.com / files/164950/Kernel-Live-Patch-Security-Notice-LSN-0082-1.html
Third Party AdvisoryVDB Entry
git.kernel.org / pub/scm/linux/kernel/git/torvalds/linux.git/commit
PatchVendor Advisory
lists.debian.org / debian-lts-announce/2021/02/msg00018.html
Mailing ListThird Party Advisory
lists.debian.org / debian-lts-announce/2021/03/msg00010.html
Mailing ListThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/BOB25SU6XUL4TNP7KB63WNZSYTIYFDPP
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/MZ7OAKAEFAXQRGBZK4LYUWINCD3D2XCL
security.netapp.com / advisory/ntap-20210122-0001
Third Party Advisory
debian.org / security/2021/dsa-4843
Third Party Advisory
oracle.com / security-alerts/cpuoct2021.html
PatchThird Party Advisory
openwall.com / lists/oss-security/2020/12/10/1
Mailing ListPatchThird Party Advisory