CVE-2019-11478

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770CWE-400

Affected software

VendorProductVersions
LinuxLinux kernel>= 4.4, < 4.4.182; >= 4.9, < 4.9.182; >= 4.14, < 4.14.127; >= 4.19, < 4.19.52; >= 5.1, < 5.1.11

References

Timeline

Published
Jun 19, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-114797.5Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queCVE-2019-11485.5An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory. An attackCVE-2019-114808.1The pc-kernel snap build process hardcoded the --allow-insecure-repositories and --allow-unauthenticated apt options when creating the buildCVE-2019-114817.8Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a CVE-2019-114824.7Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be writtenCVE-2019-114833.3Sander Bos discovered Apport mishandled crash dumps originating from containers. This could be used by a local attacker to generate a crash CVE-2019-114847.8Kevin Backhouse discovered an integer overflow in bson_ensure_space, as used in whoopsie.CVE-2019-114853.3Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling.CVE-2019-114867.0The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions.CVE-2019-114877.8The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RCVE-2019-114888.1Incorrect Access Control in the Account Access / Password Reset Link in SimplyBook.me Enterprise before 2019-04-23 allows Unauthorized AttacCVE-2019-114898.8Incorrect Access Control in the Administrative Management Interface in SimplyBook.me Enterprise before 2019-04-23 allows Authenticated Low-P
CVE-2019-11478: High severity, CVSS 7.5 | Vulnix