CVE-2019-19527: debian debian_linux Use After Free
Vulnerability summary
CVE-2019-19527 is a high (CVSS 7.2) Use After Free vulnerability in debian debian_linux. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 38.7% of scored vulnerabilities.
Not severe (CVSS 6.8, physical access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 18 · Related 13Timeline
- 03-12-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver, aka CID-9c09b214f30e.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST6.8MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.45%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.45% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: physical access, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat43 products
- bpftool< 0:3.10.0-1062.36.1.el7
- bpftool-debuginfo< 0:3.10.0-1062.36.1.el7
- kernel< 0:3.10.0-1062.36.1.el7
- kernel-abi-whitelists< 0:3.10.0-1062.36.1.el7
- kernel-bootwrapper< 0:3.10.0-1062.36.1.el7
Ubuntu28 products
- linuxAll versions (No fix recorded) | < 4.4.0-166.195 | < 4.15.0-65.74
- linux-aws< 4.4.0-1056.60 | < 4.4.0-1096.107 | < 4.15.0-1051.53
- linux-aws-fips< 4.15.0-2018.18 | All versions (No fix recorded)
- linux-aws-hwe< 4.15.0-1051.53~16.04.1
- linux-azure< 4.15.0-1060.65~14.04.1 | < 4.15.0-1060.65 | < 5.0.0-1022.23~18.04.1
Debian2 products
- linux< 5.2.17-1
- debian_linuxEOL8.0
Linux1 product
- linux_kernel≥ 2.6.30, < 3.16.79 | ≥ 3.17, < 4.4.190 | ≥ 4.5, < 4.9.190 | ≥ 4.10, < 4.14.140 | ≥ 4.15, < 4.19.68 | ≥ 4.20, < 5.2.10
Opensuse1 product
- leapEOL15.1
5 vendors · 75 products
References
21 links- cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.10X Refsource MISCREPORTIssue TrackingVendor Advisory
- www.openwall.com/lists/oss-security/2019/12/03/4Mailing ListX Refsource MLISTREPORTThird Party Advisory
lists.debian.org/debian-lts-announce/2020/01/msg00013.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
