CVE-2019-1999: Canonical Ubuntu Linux

High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days.

In binder_alloc_free_page of binder_alloc.c, there is a possible double free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-120025196.

Affected products

• Canonical Ubuntu Linux: version 19.04 only
• Debian Debian Linux: version 9.0 only; version 10.0 only
• Google Android: affected versions not specified

Published 2019-02-28. Last modified 2026-06-17.