What’s Vulnerable › Vulnerabilities

CVE-2019-18807

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-07 · updated 2026-06-17
• Weakness: CWE-401

Description

Two memory leaks in the sja1105_static_config_upload() function in drivers/net/dsa/sja1105/sja1105_spi.c in the Linux kernel before 5.3.5 allow attackers to cause a denial of service (memory consumption) by triggering static_config_buf_prepare_for_upload() or sja1105_inhibit_tx() failures, aka CID-68501df92d11.

Affected products

• Linux kernel: before 5.3.5 — fixed in 5.3.5

How to fix

Upgrade to a fixed version: Linux kernel 5.3.5. Check the vendor advisory for mitigations.

References

• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.5
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=68501df92d116b760777a2cfda314789f926476f
• https://security.netapp.com/advisory/ntap-20191205-0001/
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.5
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=68501df92d116b760777a2cfda314789f926476f
• https://security.netapp.com/advisory/ntap-20191205-0001/

Get alerted when CVE-2019-18807 or the next vulnerability affects your stack