---
id: CVE-2020-11494
title: >-
  An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux
  kernel 3.16 through 5.6.2
summary: >-
  An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux
  kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame
  data, potentially containing sensitive information from kernel stack memory,
  if th…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-908
  - CWE-909
  - CWE-200
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 3.16, <= 5.6.2'
  - leap = 15.1
  - debian_linux = 8.0
  - debian_linux = 9.0
  - ubuntu_linux = 14.04
  - ubuntu_linux = 16.04
  - ubuntu_linux = 18.04
  - ubuntu_linux = 19.10
published: '2020-04-02'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T21:17:20.893'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-11494'
references:
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html'
    label: cve@mitre.org
  - url: >-
      http://packetstormsecurity.com/files/159565/Kernel-Live-Patch-Security-Notice-LSN-0072-1.html
    label: cve@mitre.org
  - url: >-
      https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=08fadc32ce6239dc75fd5e869590e29bc62bbc28
    label: cve@mitre.org
  - url: >-
      https://github.com/torvalds/linux/commit/b9258a2cece4ec1f020715fe3554bc2e360f6264
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html'
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20200430-0004/'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4363-1/'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4364-1/'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4368-1/'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4369-1/'
    label: cve@mitre.org
  - url: 'https://www.debian.org/security/2020/dsa-4698'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      http://packetstormsecurity.com/files/159565/Kernel-Live-Patch-Security-Notice-LSN-0072-1.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=08fadc32ce6239dc75fd5e869590e29bc62bbc28
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/torvalds/linux/commit/b9258a2cece4ec1f020715fe3554bc2e360f6264
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20200430-0004/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4363-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4364-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4368-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4369-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.debian.org/security/2020/dsa-4698'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-11494.json
  - url: 'https://access.redhat.com/security/cve/CVE-2020-11494'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1826030'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2020-11494'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-11494'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00722
epssPercentile: 0.52655
ingestedAt: '2026-10-08T22:11:53.712Z'
---

## Overview

An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL, aka CID-b9258a2cece4.

## Affected

- `linux_kernel >= 3.16, <= 5.6.2`
- `leap = 15.1`
- `debian_linux = 8.0`
- `debian_linux = 9.0`
- `ubuntu_linux = 14.04`
- `ubuntu_linux = 16.04`
- `ubuntu_linux = 18.04`
- `ubuntu_linux = 19.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · updated 2026-10-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-11494.json)