CVE-2019-15538: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days.

An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.

Affected products

• Canonical Ubuntu Linux: version 16.04 only; version 18.04 only; version 19.04 only
• Debian Debian Linux: version 8.0 only
• Fedoraproject Fedora: version 29 only; version 30 only
• Linux Linux Kernel: from 4.7, before 4.9.191 (fixed in 4.9.191); from 4.14, before 4.14.141 (fixed in 4.14.141); from 4.19, before 4.19.69 (fixed in 4.19.69); from 5.2, before 5.2.11 (fixed in 5.2.11); version 5.3 only
• Netapp Aff a700s Firmware: affected versions not specified
• Netapp Data Availability Services: affected versions not specified
• Netapp h300e Firmware: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410c Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500e Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h610s Firmware: affected versions not specified
• Netapp h700e Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Hci Management Node: affected versions not specified
• Netapp Solidfire: affected versions not specified
• Opensuse Leap: version 15.0 only; version 15.1 only

Published 2019-08-25. Last modified 2026-06-17.