CVE-2019-19816

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-12-17 · updated 2026-06-17
Weakness: CWE-787

Description

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a value of 1 for the number of data stripes is mishandled.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04
Debian Linux: 9.0
Linux kernel: from 2.6.12 before 4.4.247; from 4.5 before 4.9.247; from 4.10 before 4.14.210; from 4.15 before 4.19.137; from 4.20 before 5.2 — fixed in 4.14.210, 4.19.137, 4.4.247, 4.9.247, 5.2
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 9.5
NetApp Aff A400 Firmware: all versions
NetApp Aff A700S Firmware: all versions
NetApp Data Availability Services: all versions
NetApp Fas8300 Firmware: all versions
NetApp Fas8700 Firmware: all versions
NetApp H610S Firmware: all versions
NetApp Hci Management Node: all versions
NetApp Solidfire: all versions
NetApp Steelstore Cloud Integrated Storage: all versions

How to fix

Upgrade to a fixed version: Linux kernel 4.14.210, 4.19.137, 4.4.247, 4.9.247. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-19816 or the next vulnerability affects your stack