CVE-2019-18805: Broadcom Fabric Operating System

Critical severity, CVSS 9.8. EPSS: 3.4% chance of exploitation in the next 30 days.

An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6.

Affected products

• Broadcom Fabric Operating System: affected versions not specified
• Linux Linux Kernel: from 4.4, before 4.4.180 (fixed in 4.4.180); from 4.9, before 4.9.172 (fixed in 4.9.172); from 4.14, before 4.14.115 (fixed in 4.14.115); from 4.19, before 4.19.38 (fixed in 4.19.38); from 5.0, before 5.0.11 (fixed in 5.0.11); version 5.1 only
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Aff a400 Firmware: affected versions not specified
• Netapp Aff a700s Firmware: affected versions not specified
• Netapp Data Availability Services: affected versions not specified
• Netapp E-Series Santricity OS Controller: from 11.0.0, up to and including 11.60.3
• Netapp FAS8300 Firmware: affected versions not specified
• Netapp FAS8700 Firmware: affected versions not specified
• Netapp h610s Firmware: affected versions not specified
• Netapp Hci Compute Node: affected versions not specified
• Netapp Hci Management Node: affected versions not specified
• Netapp Hci Storage Node: affected versions not specified
• Netapp Solidfire: affected versions not specified
• Netapp Steelstore Cloud Integrated Storage: affected versions not specified
• Opensuse Leap: version 15.0 only; version 15.1 only
• Red Hat Enterprise Linux: version 7.0 only

Published 2019-11-07. Last modified 2026-06-17.