CVE-2019-3882: Canonical Ubuntu Linux

Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days.

A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). Versions 3.10, 4.14 and 4.18 are vulnerable.

Affected products

Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only; version 18.10 only; version 19.04 only
Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
Fedoraproject Fedora: any version
Linux Linux Kernel: version 3.10 only; version 4.14 only; version 4.18 only
Netapp Active Iq Unified Manager For VMware Vsphere: from 9.5
Netapp CN1610 Firmware: affected versions not specified
Netapp Hci Management Node: affected versions not specified
Netapp Snapprotect: affected versions not specified
Netapp Solidfire: affected versions not specified
Netapp Storage Replication Adapter For Clustered Data Ontap For VMware Vsphere: from 7.2
Netapp Vasa Provider For Clustered Data Ontap: from 7.2
Netapp Virtual Storage Console For VMware Vsphere: from 7.2
Opensuse Leap: version 15.0 only; version 15.1 only; version 42.3 only

Published 2019-04-24. Last modified 2026-06-17.