CVE-2019-12615

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-03 · updated 2026-06-17
Weakness: CWE-476

Description

An issue was discovered in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup_const of node_info->vdev_port.name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).

Affected products

Linux kernel: from 2.6.12.1 before 4.14.130; from 4.19 before 4.19.56; from 5.1 before 5.1.15; 2.6.12-rc2, 2.6.12-rc3, 2.6.12-rc4, 2.6.12-rc5, 2.6.12-rc6, 5.2-rc1 (+3) — fixed in 4.14.130, 4.19.56, 5.1.15
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 9.5
NetApp Aff A700S Firmware: all versions
NetApp Cn1610 Firmware: all versions
NetApp H610S Firmware: all versions
NetApp Hci Management Node: all versions
NetApp Solidfire: all versions

How to fix

Upgrade to a fixed version: Linux kernel 4.14.130, 4.19.56, 5.1.15. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-12615 or the next vulnerability affects your stack