CVE-2019-19052: Broadcom Brocade Fabric Operating System Firmware

High severity, CVSS 7.5. EPSS: 5.4% chance of exploitation in the next 30 days.

A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-fb5be6a7b486.

Affected products

Broadcom Brocade Fabric Operating System Firmware: affected versions not specified
Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only; version 19.04 only; version 19.10 only
Debian Debian Linux: version 8.0 only
Linux Linux Kernel: from 3.16, before 3.16.79 (fixed in 3.16.79); from 3.17, before 4.4.201 (fixed in 4.4.201); from 4.5, before 4.9.201 (fixed in 4.9.201); from 4.10, before 4.14.154 (fixed in 4.14.154); from 4.15, before 4.19.84 (fixed in 4.19.84); from 4.20, before 5.3.11 (fixed in 5.3.11)
Netapp Active Iq Unified Manager: affected versions not specified
Netapp Aff Baseboard Management Controller: affected versions not specified
Netapp Cloud Backup: affected versions not specified
Netapp Data Availability Services: affected versions not specified
Netapp E-Series Santricity OS Controller: version 11.0 only; version 11.0.0 only; version 11.20 only; version 11.25 only; version 11.30 only; version 11.30.5r3 only; …
Netapp Fas/aff Baseboard Management Controller: affected versions not specified
Netapp Hci Baseboard Management Controller: version h610s only
Netapp Hci Compute Node Firmware: affected versions not specified
Netapp Solidfire, Enterprise Sds & Hci Storage Node: affected versions not specified
Netapp Solidfire & Hci Management Node: affected versions not specified
Netapp Solidfire Baseboard Management Controller Firmware: affected versions not specified
Netapp Steelstore Cloud Integrated Storage: affected versions not specified
Opensuse Leap: version 15.1 only
Oracle SD-WAN Edge: version 8.2 only

Published 2019-11-18. Last modified 2026-06-17.