What’s Vulnerable › Vulnerabilities

CVE-2019-10126

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-06-14 · updated 2026-06-17
• Weakness: CWE-122

Description

A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other consequences.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 19.04
• Debian Linux: 8.0, 9.0
• Linux kernel: from 4.2 before 4.4.186; from 4.5 before 4.9.186; from 4.10 before 4.14.134; from 4.15 before 4.19.59; from 4.20 before 5.1.18 — fixed in 4.14.134, 4.19.59, 4.4.186, 4.9.186, 5.1.18
• NetApp A700S Firmware: all versions
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 9.5
• NetApp Cn1610 Firmware: all versions
• NetApp H610S Firmware: all versions
• NetApp Hci Management Node: all versions
• NetApp Solidfire: all versions
• openSUSE Leap: 15.0, 15.1
• Red Hat Enterprise Linux: 8.0
• RedHat Enterprise Linux Aus: 8.2, 8.4
• RedHat Enterprise Linux Desktop: 7.0
• RedHat Enterprise Linux Eus: 7.7, 8.1, 8.2, 8.4
• RedHat Enterprise Linux For Real Time: 7, 8
• RedHat Enterprise Linux For Real Time For Nfv: 7
• RedHat Enterprise Linux For Real Time For Nfv Tus: 8.2, 8.4
• RedHat Enterprise Linux For Real Time Tus: 8.2, 8.4
• RedHat Enterprise Linux Server: 7.0, 8.0
• RedHat Enterprise Linux Server Aus: 7.7
• RedHat Enterprise Linux Server Tus: 7.7, 8.2, 8.4
• RedHat Enterprise Linux Workstation: 7.0
• RedHat Virtualization: 4.0

How to fix

Upgrade to a fixed version: Linux kernel 4.14.134, 4.19.59, 4.4.186, 4.9.186. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00014.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00025.html
• http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
• http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html
• http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html
• http://www.securityfocus.com/bid/108817
• https://access.redhat.com/errata/RHSA-2019:3055
• https://access.redhat.com/errata/RHSA-2019:3076
• https://access.redhat.com/errata/RHSA-2019:3089
• https://access.redhat.com/errata/RHSA-2019:3309
• https://access.redhat.com/errata/RHSA-2019:3517
• https://access.redhat.com/errata/RHSA-2020:0174

Get alerted when CVE-2019-10126 or the next vulnerability affects your stack