USN-4367-2
linux regression
USN-4367-1 fixed vulnerabilities in the 5.4 Linux kernel. Unfortunately, that update introduced a regression in overlayfs. This update corrects the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the btrfs implementation in the Linux kernel did not properly detect that a block was marked dirty in some situations. An attacker could use this to specially craft a file system image that, when unmounted, could cause a denial of service (system crash). (CVE-2019-19377)
It was discovered that the linux kernel did not properly validate certain mount options to the tmpfs virtual memory file system. A local attacker with the ability to specify mount options could use this to cause a denial of service (system crash). (CVE-2020-11565)
It was discovered that the block layer in the Linux kernel contained a race condition leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2020-12657)
What each source reports
OSV No score
linux regression
USN-4367-1 fixed vulnerabilities in the 5.4 Linux kernel. Unfortunately, that update introduced a regression in overlayfs. This update corrects the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the btrfs implementation in the Linux kernel did not properly detect that a block was marked dirty in some situations. An attacker could use this to specially craft a file system image that, when unmounted, could cause a denial of service (system crash). (CVE-2019-19377)
It was discovered that the linux kernel did not properly validate certain mount options to the tmpfs virtual memory file system. A local attacker with the ability to specify mount options could use this to cause a denial of service (system crash). (CVE-2020-11565)
It was discovered that the block layer in the Linux kernel contained a race condition leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2020-12657)
- Record
USN-4367-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
linuxUbuntu:20.04:LTS |
before 5.4.0-33.37, plus listed versions 5.3.0-18.195.3.0-24.265.4.0-9.125.4.0-18.225.4.0-21.25 Show 6 moreShow less5.4.0-24.285.4.0-25.295.4.0-26.305.4.0-28.325.4.0-29.335.4.0-31.35 |
5.4.0-33.37 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-4367-2 is a vulnerability with no CVSS score yet in linux, published May 28, 2020. No source lists public exploit code. Fixed in linux 5.4.0-33.37.