CVE-2019-19807

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11Release Notes, Vendor Advisory
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e7af6307a8a54f0b873960b32b6a644f2d0fbd97Exploit, Patch, Vendor Advisory
https://github.com/torvalds/linux/commit/e7af6307a8a54f0b873960b32b6a644f2d0fbd97Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20200103-0001/Third Party Advisory
https://usn.ubuntu.com/4225-1/Third Party Advisory
https://usn.ubuntu.com/4227-1/Third Party Advisory
https://usn.ubuntu.com/4227-2/Third Party Advisory
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11Release Notes, Vendor Advisory
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e7af6307a8a54f0b873960b32b6a644f2d0fbd97Exploit, Patch, Vendor Advisory
https://github.com/torvalds/linux/commit/e7af6307a8a54f0b873960b32b6a644f2d0fbd97Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20200103-0001/Third Party Advisory
https://usn.ubuntu.com/4225-1/Third Party Advisory
https://usn.ubuntu.com/4227-1/Third Party Advisory
https://usn.ubuntu.com/4227-2/Third Party Advisory

Timeline

Published: Dec 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-19815.8A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, an CVE-2019-1981010.0Zoom Call Recording 6.3.1 from Eleveo is vulnerable to Java Deserialization attacks targeting the inbuilt RMI service. A remote unauthentica CVE-2019-198135.5In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can CVE-2019-198147.8In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause __remove_dirty_segment slab-out-of-bounds write access becaus CVE-2019-198155.5In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause a NULL pointer dereference in f2fs_recover_fsync_data in fs/f CVE-2019-198167.8In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write acce CVE-2019-198175.5The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x2e8a Out-CVE-2019-198185.5The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0xa08a Out-CVE-2019-198195.5The JBIG2Globals library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x90ec NUL CVE-2019-19825.3A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for AS CVE-2019-198207.8An invalid pointer vulnerability in IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve CVE-2019-198218.1A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information a