CVE-2019-10140: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. An attacker with local access can create a denial of service situation via NULL pointer dereference in ovl_posix_acl_create function in fs/overlayfs/dir.c. This can allow attackers with ability to create directories on overlayfs to crash the kernel creating a denial of service (DOS).

Affected products

• Linux Linux Kernel: up to and including 3.10
• Red Hat Enterprise Linux: version 7.0 only

Published 2019-08-15. Last modified 2026-06-17.