What’s Vulnerable › Vulnerabilities

CVE-2019-11810

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-05-07 · updated 2026-06-17
• Weakness: CWE-416

Description

An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 19.04
• Debian Linux: 8.0
• Linux kernel: before 3.16.69; from 3.17 before 3.18.139; from 3.19 before 4.4.179; from 4.5 before 4.9.168; from 4.10 before 4.14.111; from 4.15 before 4.19.34 — fixed in 3.16.69, 3.18.139, 4.14.111, 4.19.34, 4.4.179, 4.9.168

How to fix

Upgrade to a fixed version: Linux kernel 3.16.69, 3.18.139, 4.14.111, 4.19.34. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00055.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html
• http://www.securityfocus.com/bid/108286
• https://access.redhat.com/errata/RHSA-2019:1959
• https://access.redhat.com/errata/RHSA-2019:1971
• https://access.redhat.com/errata/RHSA-2019:2029
• https://access.redhat.com/errata/RHSA-2019:2043
• https://access.redhat.com/errata/RHSA-2019:2736
• https://access.redhat.com/errata/RHSA-2019:2837
• https://access.redhat.com/errata/RHSA-2019:3217
• https://access.redhat.com/errata/RHSA-2020:0036
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.7

Get alerted when CVE-2019-11810 or the next vulnerability affects your stack