CVE-2019-19447

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-12-08 · updated 2026-06-17
Weakness: CWE-416

Description

In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list in fs/ext4/super.c.

Affected products

Linux kernel: from 2.6.12 before 3.16.82; from 3.17 before 4.4.208; from 4.5.0 before 4.9.208; from 4.10 before 4.14.159; from 4.15 before 4.19.90; from 4.20 before 5.3.17 — fixed in 3.16.82, 4.14.159, 4.19.90, 4.4.208, 4.9.208, 5.3.17
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
NetApp Cloud Backup: all versions
NetApp Data Availability Services: all versions
NetApp Hci Baseboard Management Controller: h610s
NetApp Solidfire Baseboard Management Controller: all versions
NetApp Steelstore Cloud Integrated Storage: all versions

How to fix

Upgrade to a fixed version: Linux kernel 3.16.82, 4.14.159, 4.19.90, 4.4.208. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-19447 or the next vulnerability affects your stack