What’s Vulnerable › Vulnerabilities

CVE-2019-19965

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-12-25 · updated 2026-10-08
• Weakness: CWE-476

Description

In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition, aka CID-f70267f379b5.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 19.10
• Debian Linux: 8.0
• Linux kernel: through 5.4.6
• NetApp 8300 Firmware: all versions
• NetApp 8700 Firmware: all versions
• NetApp A400 Firmware: all versions
• NetApp A700S Firmware: all versions
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp Cloud Backup: all versions
• NetApp Data Availability Services: all versions
• E-Series SANtricity OS Controller Software 11.x: from 11.0.0 through 11.70.1
• NetApp H610S Firmware: all versions
• NetApp Hci Management Node: all versions
• NetApp Solidfire: all versions
• NetApp Steelstore Cloud Integrated Storage: all versions
• openSUSE Leap: 15.1

References

• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f70267f379b5e5e11bdc5d72a56bf17e5feed01f
• https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html
• https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
• https://security.netapp.com/advisory/ntap-20200204-0002/
• https://usn.ubuntu.com/4284-1/
• https://usn.ubuntu.com/4285-1/
• https://usn.ubuntu.com/4286-1/
• https://usn.ubuntu.com/4286-2/
• https://usn.ubuntu.com/4287-1/
• https://usn.ubuntu.com/4287-2/
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html

Get alerted when CVE-2019-19965 or the next vulnerability affects your stack