usbsgcancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer occurs without a reference, aka CID-056ad39ee925.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-12464.json"
[
{
"digest": {
"line_hashes": [
"255943705818962813189976031016472597529",
"26033224937548943097948035650581242614",
"526934606920560820297120827636957638",
"31740174451050260298108892113833111941",
"88334139816857127022371209949018334689",
"83400255864374188643152245675839267384",
"18976699313310297325405290768711954450",
"295323004618949905759279342173215295091",
"87686149460333506480774470036864217880",
"243721719629647059646551031181529773032",
"148076998368388731406663931420594976352",
"152475867996944593949176481686230090508"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/usb/core/message.c"
},
"signature_type": "Line",
"id": "CVE-2020-12464-2d8fd261",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@056ad39ee9253873522f6469c3364964a322912b",
"deprecated": false
},
{
"digest": {
"function_hash": "3645988281826647388253086379590913140",
"length": 555.0
},
"signature_version": "v1",
"target": {
"file": "drivers/usb/core/message.c",
"function": "usb_sg_cancel"
},
"signature_type": "Function",
"id": "CVE-2020-12464-9c2bd0b9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@056ad39ee9253873522f6469c3364964a322912b",
"deprecated": false
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-12464.json"
[
{
"digest": {
"line_hashes": [
"255943705818962813189976031016472597529",
"26033224937548943097948035650581242614",
"526934606920560820297120827636957638",
"31740174451050260298108892113833111941",
"88334139816857127022371209949018334689",
"83400255864374188643152245675839267384",
"18976699313310297325405290768711954450",
"295323004618949905759279342173215295091",
"87686149460333506480774470036864217880",
"243721719629647059646551031181529773032",
"148076998368388731406663931420594976352",
"152475867996944593949176481686230090508"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/usb/core/message.c"
},
"signature_type": "Line",
"id": "CVE-2020-12464-db1a3011",
"source": "https://github.com/torvalds/linux/commit/056ad39ee9253873522f6469c3364964a322912b",
"deprecated": false
},
{
"digest": {
"function_hash": "3645988281826647388253086379590913140",
"length": 555.0
},
"signature_version": "v1",
"target": {
"file": "drivers/usb/core/message.c",
"function": "usb_sg_cancel"
},
"signature_type": "Function",
"id": "CVE-2020-12464-fd0fde17",
"source": "https://github.com/torvalds/linux/commit/056ad39ee9253873522f6469c3364964a322912b",
"deprecated": false
}
]