VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 18, 2019· Updated Aug 5, 2024

CVE-2019-19066

CVE-2019-19066

Description

A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering bfa_port_get_stats() failures, aka CID-0e62395da2bd.

Affected products

135

Patches

1
0e62395da2bd

scsi: bfa: release allocated memory in case of error

https://github.com/torvalds/linuxNavid EmamdoostSep 10, 2019via osv
commit
1 file changed · +3 −1
  • drivers/scsi/bfa/bfad_attr.c+3 −1 modified
    @@ -275,8 +275,10 @@ bfad_im_get_stats(struct Scsi_Host *shost)
 	rc = bfa_port_get_stats(BFA_FCPORT(&bfad->bfa),
 				fcstats, bfad_hcb_comp, &fcomp);
 	spin_unlock_irqrestore(&bfad->bfad_lock, flags);
-	if (rc != BFA_STATUS_OK)
+	if (rc != BFA_STATUS_OK) {
+		kfree(fcstats);
 		return NULL;
+	}
 
 	wait_for_completion(&fcomp.comp);

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.