CVE-2019-14898: linux kernel kernel
Vulnerability summary
CVE-2019-14898 is a high (CVSS 7.0) vulnerability in linux kernel kernel. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.9% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4Timeline
- 08-05-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive information, cause a denial of service, or possibly have other unspecified impacts by triggering a race condition with mmget_not_zero or get_task_mm calls.
CVSS metrics
6 scores · 3 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.0HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.0HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.44% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (bugs.chromium.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
- CWE-667Improper LockingThe product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu5 products
- linuxAll versions (No fix recorded)
- linux-awsAll versions (No fix recorded)
- linux-azureAll versions (No fix recorded)
- linux-hwe-edgeAll versions (No fix recorded)
- linux-lts-xenialAll versions (No fix recorded)
Linux1 product
- linux_kernel5.0.10
Linux kernel1 product
- kernel< 5.0.10
Redhat1 product
4 vendors · 8 products
References
9 links- www.oracle.com/security-alerts/cpuApr2021.htmlX Refsource MISC
- bugs.chromium.org/p/project-zero/issues/detail?id=1790X Refsource MISCExploitMailing ListPatchThird Party Advisory
- security.netapp.com/advisory/ntap-20200608-0001/X Refsource CONFIRM
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14898X Refsource CONFIRMIssue TrackingThird Party Advisory