CVE-2019-20095

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-30 · updated 2026-10-08
Weakness: CWE-401

Description

mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82. This will cause a memory leak and denial of service.

Affected products

Linux kernel: before 5.1.6 — fixed in 5.1.6
NetApp 8300 Firmware: all versions
NetApp 8700 Firmware: all versions
NetApp A400 Firmware: all versions
NetApp A700S Firmware: all versions
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
NetApp Cloud Backup: all versions
NetApp Data Availability Services: all versions
E-Series SANtricity OS Controller Software 11.x: from 11.0.0 through 11.70.1
NetApp H610S Firmware: all versions
NetApp Hci Management Node: all versions
NetApp Solidfire: all versions
NetApp Steelstore Cloud Integrated Storage: all versions
openSUSE Leap: 15.1

How to fix

Upgrade to a fixed version: Linux kernel 5.1.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-20095 or the next vulnerability affects your stack