peter bassill · operator
$ cve CVE-2019-6974 JSON

CVE-2019-6974 EXPLOIT

8.1
HIGH · CVSS 3.1 · EPSS 16.5% (pctl 97)

Patch early

A public exploit exists.

Description

In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.

Scoring

CVSS8.1 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS16.52% — more likely to be exploited than 97% of all CVEs
WeaknessCWE-362
On CISA KEVno
Public exploityes
Published2019-02-15
Last modified2026-06-17

Affected (24)

VendorProduct
canonicalubuntu linux
debiandebian linux
f5big-ip access policy manager
f5big-ip advanced firewall manager
f5big-ip analytics
f5big-ip application acceleration manager
f5big-ip application security manager
f5big-ip edge gateway
f5big-ip fraud protection service
f5big-ip global traffic manager
f5big-ip link controller
f5big-ip local traffic manager
f5big-ip policy enforcement manager
f5big-ip webaccelerator
linuxlinux kernel
redhatenterprise linux
redhatenterprise linux desktop
redhatenterprise linux eus
redhatenterprise linux server
redhatenterprise linux server aus
redhatenterprise linux server eus
redhatenterprise linux server tus
redhatenterprise linux workstation
redhatopenshift container platform

Public exploits

SourceTitleDate
exploit-dbLinux - 'kvm_ioctl_create_device()' NULL Pointer Dereference2019-02-15

References

→ the Explorer  ·  watch your stack  ·  NVD