CVE-2020-14385

A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. The highest threat from this vulnerability is to system availability.

• CWE-131
• CWE-131

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.htmlBroken Link
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14385Issue Tracking, Third Party Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f4020438fab05364018c91f7e02ebdd192085933Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/4576-1/Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.htmlBroken Link
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14385Issue Tracking, Third Party Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f4020438fab05364018c91f7e02ebdd192085933Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/4576-1/Third Party Advisory

Published

Sep 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1438An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2020-14380An account takeover flaw was found in Red Hat Satellite 6.7.…7.5
• CVE-2020-14381A flaw was found in the Linux kernel’s futex implementation.…7.8
• CVE-2020-14382A vulnerability was found in upstream release cryptsetup-2.2…7.8
• CVE-2020-14383A flaw was found in samba's DNS server. An authenticated use…6.5
• CVE-2020-14384A flaw was found in JBossWeb in versions before 7.5.31.Final…7.5
• CVE-2020-14386A flaw was found in the Linux kernel before 5.9-rc4. Memory …7.8
• CVE-2020-14387A flaw was found in rsync in versions since 3.2.0pre1. Rsync…7.4
• CVE-2020-14388A flaw was found in the Red Hat 3scale API Management Platfo…6.3
• CVE-2020-14389It was found that Keycloak before version 12.0.0 would permi…8.1
• CVE-2020-1439A remote code execution vulnerability exists in PerformanceP…8.8
• CVE-2020-14390A flaw was found in the Linux kernel in versions before 5.9-…5.6