---
id: CVE-2020-28097
title: >-
  The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software
  scrollback
summary: >-
  The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software
  scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka
  CID-973c096f6a85.
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cwe:
  - CWE-125
vendor: netapp
product: cloud_backup
affected:
  - linux_kernel < 5.8.10
  - cloud_backup
  - h410c_firmware
  - h300s_firmware
  - h500s_firmware
  - h700s_firmware
  - h300e_firmware
  - h500e_firmware
  - h700e_firmware
  - h410s_firmware
patched:
  - linux_kernel 5.8.10
published: '2021-06-24'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T21:17:27.767'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-28097'
references:
  - url: 'https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.10'
    label: cve@mitre.org
  - url: >-
      https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=973c096f6a85e5b5f2a295126ba6928d9a6afd45
    label: cve@mitre.org
  - url: >-
      https://github.com/torvalds/linux/commit/973c096f6a85e5b5f2a295126ba6928d9a6afd45
    label: cve@mitre.org
  - url: 'https://seclists.org/oss-sec/2020/q3/176'
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20210805-0001/'
    label: cve@mitre.org
  - url: 'https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.10'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=973c096f6a85e5b5f2a295126ba6928d9a6afd45
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/torvalds/linux/commit/973c096f6a85e5b5f2a295126ba6928d9a6afd45
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://seclists.org/oss-sec/2020/q3/176'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20210805-0001/'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00519
epssPercentile: 0.4225
ingestedAt: '2026-10-08T22:11:53.737Z'
---

## Overview

The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85.

## Affected

- `linux_kernel < 5.8.10`
- `cloud_backup`
- `h410c_firmware`
- `h300s_firmware`
- `h500s_firmware`
- `h700s_firmware`
- `h300e_firmware`
- `h500e_firmware`
- `h700e_firmware`
- `h410s_firmware`

## Remediation

Upgrade past the affected range:

- `linux_kernel 5.8.10`