Read the docs
TI-2019-11865 Aliases CVE-2019-15794GHSA-33f2-r445-jvq6

Reference counting error in overlayfs/shiftfs error path when used in conjuction with aufs

Priority LOW 34CWE-672Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for the file to which vm_file points. On upstream kernels this is not an issue, as no callers dereference vm_file following after call_mmap() returns an error. However, the aufs patchs change mmap_region() to replace the fput() using a local variable with vma_fput(), which will fput() vm_file, leading to a refcount underflow.

Why it matters now

EPSS 0.01158 67th percentileScored 2026-11-07
Fix Partial Linux kernel (Ubuntu): 5.3.0-24.26, 5.0.0-37.40Red Hat: 1 advisoryRed Hat: 2 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UbuntuLinux kernel5.3 kernel to before 5.3.0-24.26; 5.0 kernel to before 5.0.0-37.405.3.0-24.26, 5.0.0-37.40Patch availableCNA
  • Linux kernel VendorUbuntu Affected 5.3 kernel to before 5.3.0-24.26; 5.0 kernel to before 5.0.0-37.40 Fixed in 5.3.0-24.26, 5.0.0-37.40 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:5.0:*:*:*:*:*:*:*5.0VulnerableLinux
cpe:2.3:o:linux:linux_kernel:5.3:*:*:*:*:*:*:*5.3VulnerableLinux
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*19.10VulnerableCanonical
  • cpe:2.3:o:linux:linux_kernel:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:5.3:*:*:*:*:*:*:* Versions 5.3 Vulnerable ·Linux
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Vulnerable ·Canonical

Remediation

  • Fix · CNA Linux kernel (Ubuntu) Fixed in 5.3.0-24.26, 5.0.0-37.40

Red Hat 1 advisory

  • RHSA-2021:4356 Released 2021-11-09 · Red Hat rating Moderate
    kernel security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 8) kernel-tools-libs-devel-4.18.0-348.el8
    • Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-348.el8, kernel-4.18.0-348.el8, kernel-abi-stablelists-4.18.0-348.el8 +19

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2021:4356
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2021:4356
Not affected: 4 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise MRG 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-15794
  2. 2026-10-03 Alias added: GHSA-33f2-r445-jvq6

References

Patch 2

Advisory 2

  • TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
  • TI-2007-05153 Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD… CVSS 2.0HIGH 7.2
  • TI-2004-01032 Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and… CVSS 2.0HIGH 10.0
  • TI-2004-00896 Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other… CVSS 2.0HIGH 10.0
  • TI-2004-00800 Buffer overflow in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7 may… CVSS 2.0HIGH 10.0
  • TI-2004-00962 Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to… CVSS 2.0HIGH 10.0
See all 129 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences