CVE-2019-3900

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-25 · updated 2026-06-17
Weakness: CWE-835

Description

An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario.

Affected products

Canonical Ubuntu Linux: 16.04, 18.04, 19.04
Debian Linux: 8.0, 9.0, 10.0
Fedoraproject Fedora: 29, 30, 28
Linux kernel: from 2.6.34 before 3.16.72; from 3.17 before 4.4.191; from 4.5 before 4.9.190; from 4.10 before 4.14.133; from 4.15 before 4.19.64; from 4.20 before 5.2 — fixed in 3.16.72, 4.14.133, 4.19.64, 4.4.191, 4.9.190, 5.2
NetApp Active Iq Unified Manager For Vmware Vsphere: from 9.5
NetApp Cn1610 Firmware: all versions
NetApp Hci Management Node: all versions
NetApp Snapprotect: all versions
NetApp Solidfire: all versions
NetApp Storage Replication Adapter For Clustered Data Ontap For Vmware Vsphere: from 7.2
NetApp Vasa Provider For Clustered Data Ontap: from 7.2
NetApp Virtual Storage Console For Vmware Vsphere: from 7.2
Oracle Corporation SD-WAN Edge: 8.2
Red Hat Enterprise Linux: 6.0, 7.0

How to fix

Upgrade to a fixed version: Linux kernel 3.16.72, 4.14.133, 4.19.64, 4.4.191. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-3900 or the next vulnerability affects your stack