PT-2019-4492 · Linux+2 · Linux Kernel+2

Published 2019-04-29 · Updated 2025-09-29 · CVE-2019-19813

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel version 5.0.21

Description The issue is related to a use-after-free in the Linux kernel, specifically when mounting a crafted btrfs filesystem image, performing certain operations, and then making a syncfs system call. This is connected to the functions mutex can spin on owner, btrfs qgroup free meta, and btrfs insert delayed items. The exploitation of this issue can lead to a denial of service.

Recommendations For Linux kernel version 5.0.21, consider applying a patch that fixes the use-after-free issue in the mutex lock function, specifically related to the mutex can spin on owner function in kernel/locking/mutex.c, btrfs qgroup free meta in fs/btrfs/qgroup.c, and btrfs insert delayed items in fs/btrfs/delayed-inode.c. As a temporary workaround, consider restricting the use of the syncfs system call on mounted btrfs filesystem images to minimize the risk of exploitation.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2025_12746

ALSA-2025_12752

ALSA-2025_12753

ALSA-2025_16880

ALT-PU-2019-2120

ALT-PU-2019-2311

BDU:2020-00351

CVE-2019-19813

DLA-2385-1

DLA-2586-1

ELSA-2021-9534

USN-4414-1

USN-4708-1

USN-4709-1

Affected Products

Alt Linux

Linux Kernel

Ubuntu

References · 47

• 🔥 https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19813 · Exploit
• https://osv.dev/vulnerability/DLA-2586-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19813 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4708-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13143 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19813 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19036 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-13093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19813 · Security Note
• https://usn.ubuntu.com/4414-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4414-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4414-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19462 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4709-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19377 · Vendor Advisory