What’s Vulnerable › Vulnerabilities

CVE-2019-6974

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 16.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-02-15 · updated 2026-06-17
• Weakness: CWE-362

Description

In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 18.10
• Debian Linux: 8.0
• F5 BIG-IP APM: from 13.0.0 through 13.1.1; from 14.0.0 through 14.1.0; from 15.0.0 before 15.1.0 — fixed in 15.1.0
• BIG-IP: from 13.0.0 through 13.1.1; from 14.0.0 through 14.1.0; from 15.0.0 before 15.1.0 — fixed in 15.1.0
• F5 Big-Ip Analytics: from 13.0.0 through 13.1.1; from 14.0.0 through 14.1.0; from 15.0.0 before 15.1.0 — fixed in 15.1.0
• F5 Networks, Inc. BIG-IP (AAM): from 13.0.0 through 13.1.1; from 14.0.0 through 14.1.0; from 15.0.0 before 15.1.0 — fixed in 15.1.0
• BIG-IP ASM: from 13.0.0 through 13.1.1; from 14.0.0 through 14.1.0; from 15.0.0 before 15.1.0 — fixed in 15.1.0
• F5 Big-Ip Edge Gateway: from 13.0.0 through 13.1.1; from 14.0.0 through 14.1.0; from 15.0.0 before 15.1.0 — fixed in 15.1.0
• F5 Big-Ip Fraud Protection Service: from 13.0.0 through 13.1.1; from 14.0.0 through 14.1.0; from 15.0.0 before 15.1.0 — fixed in 15.1.0
• F5 Big-Ip Global Traffic Manager: from 13.0.0 through 13.1.1; from 14.0.0 through 14.1.0; from 15.0.0 before 15.1.0 — fixed in 15.1.0
• F5 Big-Ip Link Controller: from 13.0.0 through 13.1.1; from 14.0.0 through 14.1.0; from 15.0.0 before 15.1.0 — fixed in 15.1.0
• F5 BIG-IP (LTM): from 13.0.0 through 13.1.1; from 14.0.0 through 14.1.0; from 15.0.0 before 15.1.0 — fixed in 15.1.0
• F5 Networks, Inc. BIG-IP (PEM): from 13.0.0 through 13.1.1; from 14.0.0 through 14.1.0; from 15.0.0 before 15.1.0 — fixed in 15.1.0
• F5 Big-Ip Webaccelerator: from 13.0.0 through 13.1.1; from 14.0.0 through 14.1.0; from 15.0.0 before 15.1.0 — fixed in 15.1.0
• Linux kernel: from 3.10 before 3.16.64; from 3.17 before 3.18.136; from 3.19 before 4.4.176; from 4.5 before 4.9.156; from 4.10 before 4.14.99; from 4.15 before 4.19.21 — fixed in 3.16.64, 3.18.136, 4.14.99, 4.19.21, 4.20.8, 4.4.176
• Red Hat Enterprise Linux: 7.0
• RedHat Enterprise Linux Desktop: 7.0
• RedHat Enterprise Linux Eus: 7.5
• RedHat Enterprise Linux Server: 7.0
• RedHat Enterprise Linux Server Aus: 7.4, 7.6
• RedHat Enterprise Linux Server Eus: 7.6
• RedHat Enterprise Linux Server Tus: 7.4, 7.6
• RedHat Enterprise Linux Workstation: 7.0
• Red Hat OpenShift Container Platform 4.18: 3.11

How to fix

Upgrade to a fixed version: F5 BIG-IP APM 15.1.0; BIG-IP 15.1.0; F5 Big-Ip Analytics 15.1.0; F5 Networks, Inc. BIG-IP (AAM) 15.1.0; BIG-IP ASM 15.1.0; F5 Big-Ip Edge Gateway 15.1.0; F5 Big-Ip Fraud Protection Service 15.1.0; F5 Big-Ip Global Traffic Manager 15.1.0; F5 Big-Ip Link Controller 15.1.0; F5 BIG-IP (LTM) 15.1.0; F5 Networks, Inc. BIG-IP (PEM) 15.1.0; F5 Big-Ip Webaccelerator 15.1.0. Check the vendor advisory for mitigations.

References

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cfa39381173d5f969daf43582c95ad679189cbc9
• http://www.securityfocus.com/bid/107127
• https://access.redhat.com/errata/RHBA-2019:0959
• https://access.redhat.com/errata/RHSA-2019:0818
• https://access.redhat.com/errata/RHSA-2019:0833
• https://access.redhat.com/errata/RHSA-2019:2809
• https://access.redhat.com/errata/RHSA-2019:3967
• https://access.redhat.com/errata/RHSA-2020:0103
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1765
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.99
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.21
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.8

Get alerted when CVE-2019-6974 or the next vulnerability affects your stack