CVE-2019-19922: Canonical Ubuntu Linux

Medium severity, CVSS 5.5. EPSS: 0.9% chance of exploitation in the next 30 days.

kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)

Affected products

• Canonical Ubuntu Linux: version 18.04 only; version 19.04 only
• Debian Debian Linux: version 8.0 only
• Linux Linux Kernel: before 5.3.9 (fixed in 5.3.9)
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Aff Baseboard Management Controller: version a700 only
• Netapp Cloud Backup: affected versions not specified
• Netapp Data Availability Services: affected versions not specified
• Netapp E-Series Santricity OS Controller: from 11.0, up to and including 11.70.2
• Netapp Fas/aff Baseboard Management Controller: affected versions not specified
• Netapp Hci Baseboard Management Controller: version h610s only
• Netapp Solidfire & Hci Management Node: affected versions not specified
• Netapp Solidfire Baseboard Management Controller: affected versions not specified
• Netapp Steelstore Cloud Integrated Storage: affected versions not specified
• Oracle SD-WAN Edge: version 8.2 only

Published 2019-12-22. Last modified 2026-06-17.