CVE-2019-16995: Linux Kernel

High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days.

In the Linux kernel before 5.0.3, a memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c if hsr_add_port fails to add a port, which may cause denial of service, aka CID-6caabe7f197d.

Affected products

• Linux Linux Kernel: from 3.17, before 3.18.137 (fixed in 3.18.137); from 4.4, before 4.4.177 (fixed in 4.4.177); from 4.9, before 4.9.164 (fixed in 4.9.164); from 4.14, before 4.14.107 (fixed in 4.14.107); from 4.19, before 4.19.30 (fixed in 4.19.30); from 4.20, before 4.20.17 (fixed in 4.20.17); …
• Netapp Aff a700s Firmware: affected versions not specified
• Netapp Data Availability Services: affected versions not specified
• Netapp h300e Firmware: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410c Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500e Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h610s Firmware: affected versions not specified
• Netapp h700e Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Hci Management Node: affected versions not specified
• Netapp Service Processor: affected versions not specified
• Netapp Solidfire: affected versions not specified
• Netapp Steelstore Cloud Integrated Storage: affected versions not specified
• Opensuse Leap: version 15.0 only; version 15.1 only

Published 2019-09-30. Last modified 2026-06-17.