CVE-2018-19985: Debian Linux

Medium severity, CVSS 4.6. EPSS: 1% chance of exploitation in the next 30 days.

The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space.

Affected products

• Debian Debian Linux: version 8.0 only
• Linux Linux Kernel: up to and including 4.19.8
• Netapp Active Iq Performance Analytics Services: affected versions not specified
• Netapp Element Software Management Node: affected versions not specified

Published 2019-03-21. Last modified 2026-06-17.