CVE-2019-19965
In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition, aka CID-f70267f379b5.
- Score
- CVSS 3.1 4.7 Medium
- Status
- Modified - cve@mitre.org
- Published
- 2019-12-25
- Last modified
- 2026-10-08
- Weaknesses
- CWE-476
Affected products
- Ubuntu Linux (Canonical)
- Debian Linux (Debian)
- Linux Kernel (Linux)
- 8300 Firmware (Netapp)
- 8700 Firmware (Netapp)
- A400 Firmware (Netapp)
- A700s Firmware (Netapp)
- Active Iq Unified Manager (Netapp)
- Cloud Backup (Netapp)
- Data Availability Services (Netapp)
- E-series Santricity Os Controller (Netapp)
- H610s Firmware (Netapp)
- Hci Management Node (Netapp)
- Solidfire (Netapp)
- Steelstore Cloud Integrated Storage (Netapp)
- Leap (Opensuse)
References
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f70267f379b5e5e11bdc5d72a56bf17e5feed01f
- https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html
- https://security.netapp.com/advisory/ntap-20200204-0002/
- https://usn.ubuntu.com/4285-1/
- https://usn.ubuntu.com/4287-1/
- https://usn.ubuntu.com/4286-2/
- https://usn.ubuntu.com/4287-2/
- https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
- https://usn.ubuntu.com/4284-1/
- https://usn.ubuntu.com/4286-1/
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html
