CVE-2019-15917

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-04 · updated 2026-06-17
Weakness: CWE-416

Description

An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() fails in hci_uart_set_proto() in drivers/bluetooth/hci_ldisc.c.

Affected products

Debian Linux: 8.0
Linux kernel: from 3.12.61 before 3.13; from 4.7 before 4.9.202; from 4.10 before 4.14.109; from 4.15 before 4.19.32; from 4.20 before 5.0.5 — fixed in 3.13, 4.14.109, 4.19.32, 4.9.202, 5.0.5
openSUSE Leap: 15.0, 15.1

How to fix

Upgrade to a fixed version: Linux kernel 3.13, 4.14.109, 4.19.32, 4.9.202. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html
http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.5
https://github.com/torvalds/linux/commit/56897b217a1d0a91c9920cb418d6b3fe922f590a
https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
https://seclists.org/bugtraq/2020/Jan/10
https://security.netapp.com/advisory/ntap-20191004-0001/
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html
http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html

Get alerted when CVE-2019-15917 or the next vulnerability affects your stack