TI-2019-11340 Aliases CVE-2019-15223 GHSA-47hc-xmv3-cfv3

An issue was discovered in the Linux kernel before 5.1.8.

LOW 22CWE-476Published 2019-08-19 · Updated 2024-08-05

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 4 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/driver.c driver.

Why it matters now

EPSS 0.006 48th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial Red Hat: 2 advisoriesRed Hat: 4 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPE	Versions	Role	Vendor
cpe:2.3:o:linux:linux_kernel::::::::	before 5.1.8	Vulnerable	Linux
cpe:2.3:o:netapp:h410c_firmware:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:h:netapp:h410c:-:::::::*	not specified by NVD	Running on	NetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:data_availability_services:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::	18.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:19.04:::::::*	19.04	Vulnerable	Canonical

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions before 5.1.8 Vulnerable ·Linux
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical

Remediation

Red Hat 2 advisories

RHSA-2020:1769 Released 2020-04-28 · Red Hat rating Important
kernel security, bug fix, and enhancement update
- Red Hat CodeReady Linux Builder (v. 8) kernel-tools-libs-devel-4.18.0-193.el8
- Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-193.el8, kernel-4.18.0-193.el8, kernel-abi-whitelists-4.18.0-193.el8 +19
RHSA-2020:1567 Released 2020-04-28 · Red Hat rating Important
kernel-rt security, bug fix, and enhancement update
- Red Hat Enterprise Linux Real Time (v. 8) kernel-rt-4.18.0-193.rt13.51.el8, kernel-rt-core-4.18.0-193.rt13.51.el8, kernel-rt-debug-4.18.0-193.rt13.51.el8 +7
- Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt-4.18.0-193.rt13.51.el8, kernel-rt-core-4.18.0-193.rt13.51.el8, kernel-rt-debug-4.18.0-193.rt13.51.el8 +9

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 5	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat CodeReady Linux Builder (v. 8)	Fixed	RHSA-2020:1769
Red Hat Enterprise Linux BaseOS (v. 8)	Fixed	RHSA-2020:1769
Red Hat Enterprise Linux Real Time (v. 8)	Fixed	RHSA-2020:1567
Red Hat Enterprise Linux Real Time for NFV (v. 8)	Fixed	RHSA-2020:1567

Not affected: 2 products

Red Hat Enterprise Linux 7
Red Hat Enterprise MRG 2

Timeline

2026-10-02 Threatist record created from CVE-2019-15223
2026-10-03 Alias added: GHSA-47hc-xmv3-cfv3

References

Exploit 1

https://syzkaller.appspot.com/bug?id=0c1e517c657d3de2361cb0cc2d3a8663c25039a7

Patch 1

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0b074ab7fc0d575247b9cc9f93bb7e007ca38840

Advisory 3

Other 1

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences