CVE-2019-15538
This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.92%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 3.92% probability · 90th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Affected
- linux/linux kernel · canonical/ubuntu linux · netapp/data availability services · netapp/hci management node · netapp/solidfire · netapp/aff a700s firmware · netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h300e firmware · netapp/h500e firmware · netapp/h700e firmware · netapp/h410s firmware · netapp/h410c firmware · netapp/h610s firmware · opensuse/leap · debian/debian linux · fedoraproject/fedora
- Source
- cve@mitre.org
EPSS 3.9% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.htmlMailing List, Third Party Advisory
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1fb254aa983bf190cfd685d40c64a480a9bafaeeMailing List, Patch, Vendor Advisory
- https://github.com/torvalds/linux/commit/1fb254aa983bf190cfd685d40c64a480a9bafaeePatch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/09/msg00014.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/09/msg00015.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3RUDQJXRJQVGHCGR4YZWTQ3ECBI7TXH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4JZ6AEUKFWBHQAROGMQARJ274PQP2QP/
- https://lore.kernel.org/linux-xfs/20190823035528.GH1037422%40magnolia/
- https://lore.kernel.org/linux-xfs/20190823192433.GA8736%40eldamar.local
- https://security.netapp.com/advisory/ntap-20191004-0001/Third Party Advisory
- https://support.f5.com/csp/article/K32592426?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/4144-1/Third Party Advisory
- https://usn.ubuntu.com/4147-1/Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.htmlMailing List, Third Party Advisory
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1fb254aa983bf190cfd685d40c64a480a9bafaeeMailing List, Patch, Vendor Advisory
- https://github.com/torvalds/linux/commit/1fb254aa983bf190cfd685d40c64a480a9bafaeePatch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/09/msg00014.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/09/msg00015.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3RUDQJXRJQVGHCGR4YZWTQ3ECBI7TXH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4JZ6AEUKFWBHQAROGMQARJ274PQP2QP/
- https://lore.kernel.org/linux-xfs/20190823035528.GH1037422%40magnolia/
- https://lore.kernel.org/linux-xfs/20190823192433.GA8736%40eldamar.local
- https://security.netapp.com/advisory/ntap-20191004-0001/Third Party Advisory
- https://support.f5.com/csp/article/K32592426?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/4144-1/Third Party Advisory
- https://usn.ubuntu.com/4147-1/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.