How severe is CVE-2020-10774?

CVE-2020-10774 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2020-10774 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (18th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-10774?

CVE-2020-10774 affects Linux Linux Kernel. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-10774?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-10774 published?

CVE-2020-10774 was published on 2021-05-27 and last updated on 2026-06-17.

CVE-2020-10774

CVE-2020-10774 is a medium-severity vulnerability in Linux Linux Kernel with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-805.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
CVSS v2: 2.1
EPSS exploit prediction: 0% (18th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-805
Affected product: Linux Linux Kernel
Published: 2021-05-27
Last modified: 2026-06-17

Description

A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl subsystem when reading the /proc/sys/kernel/rh_features file. This flaw allows a local user to read uninitialized values from the kernel memory. The highest threat from this vulnerability is to confidentiality.

Frequently asked questions

What is CVE-2020-10774?: A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl subsystem when reading the /proc/sys/kernel/rh_features file. This flaw allows a local user to read uninitialized values from the kernel memory. The highest threat from this vulnerability is to confidentiality.
How severe is CVE-2020-10774?: CVE-2020-10774 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2020-10774 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (18th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-10774?: CVE-2020-10774 affects Linux Linux Kernel. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-10774?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-10774 published?: CVE-2020-10774 was published on 2021-05-27 and last updated on 2026-06-17.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1846964

Affected products (1)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

More vulnerabilities in Linux Linux Kernel

CVE-2026-63795 — Critical (CVSS 10.0): In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error…
CVE-2025-38429 — Critical (CVSS 10.0): In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Update read pointer only after…
CVE-2025-22021 — Critical (CVSS 10.0): In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6…
CVE-2025-21663 — Critical (CVSS 10.0): In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac-tegra: Read iommu stream id…
CVE-2024-56719 — Critical (CVSS 10.0): In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO DMA API usage causing…
CVE-2024-44984 — Critical (CVSS 10.0): In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix double DMA unmapping for…

All CVEs affecting Linux Linux Kernel →

Other CWE-805 vulnerabilities

CVE-2020-14509 — Critical (CVSS 9.8): Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser…
CVE-2025-20315 — High (CVSS 8.6): A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an…
CVE-2025-38743 — High (CVSS 7.8): Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains a Buffer Access with Incorrect Length Value…
CVE-2025-20175 — High (CVSS 7.7): A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated,…
CVE-2025-20174 — High (CVSS 7.7): A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated,…
CVE-2025-20170 — High (CVSS 7.7): A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated,…

Browse all CWE-805 vulnerabilities →