CVE-2019-19448: Canonical Ubuntu Linux

High severity, CVSS 7.8. EPSS: 2.1% chance of exploitation in the next 30 days.

In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only
• Debian Debian Linux: version 9.0 only
• Linux Linux Kernel: from 2.6.31, before 4.4.233 (fixed in 4.4.233); from 4.5.0, before 4.9.233 (fixed in 4.9.233); from 4.10, before 4.14.194 (fixed in 4.14.194); from 4.15, before 4.19.141 (fixed in 4.19.141); from 4.20, before 5.4.60 (fixed in 5.4.60); from 5.5.0, before 5.7.17 (fixed in 5.7.17); …
• Netapp a700s Firmware: affected versions not specified
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Aff 8300 Firmware: affected versions not specified
• Netapp Aff 8700 Firmware: affected versions not specified
• Netapp Aff a400 Firmware: affected versions not specified
• Netapp Cloud Backup: affected versions not specified
• Netapp Data Availability Services: affected versions not specified
• Netapp Fas 8300 Firmware: affected versions not specified
• Netapp Fas 8700 Firmware: affected versions not specified
• Netapp Fas a400 Firmware: affected versions not specified
• Netapp h610s Firmware: affected versions not specified
• Netapp Hci Management Node: affected versions not specified
• Netapp Solidfire: affected versions not specified
• Netapp Solidfire Baseboard Management Controller Firmware: affected versions not specified
• Netapp Steelstore Cloud Integrated Storage: affected versions not specified

Published 2019-12-08. Last modified 2026-06-17.