CVE-2019-19813: Canonical Ubuntu Linux

Medium severity, CVSS 5.5. EPSS: 2.1% chance of exploitation in the next 30 days.

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in __mutex_lock in kernel/locking/mutex.c. This is related to mutex_can_spin_on_owner in kernel/locking/mutex.c, __btrfs_qgroup_free_meta in fs/btrfs/qgroup.c, and btrfs_insert_delayed_items in fs/btrfs/delayed-inode.c.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only
• Debian Debian Linux: version 9.0 only
• Linux Linux Kernel: version 5.0.21 only
• Netapp Active Iq Unified Manager: from 9.5
• Netapp Aff a400 Firmware: affected versions not specified
• Netapp Aff a700s Firmware: affected versions not specified
• Netapp Data Availability Services: affected versions not specified
• Netapp FAS8300 Firmware: affected versions not specified
• Netapp FAS8700 Firmware: affected versions not specified
• Netapp h610s Firmware: affected versions not specified
• Netapp Hci Management Node: affected versions not specified
• Netapp Solidfire: affected versions not specified
• Netapp Steelstore Cloud Integrated Storage: affected versions not specified

Published 2019-12-17. Last modified 2026-06-17.