Security readout for executives and security teams
Plain-English summary
This is a local Ubuntu kernel flaw that could let a logged-in user corrupt kernel reference counts and affect system integrity or availability. The issue is tied to Ubuntu 5.0 and 5.3 kernels using overlayfs or shiftfs in conjunction with aufs. No active exploitation is evidenced in the provided sources.
Executive priority
Treat as high priority for affected Ubuntu fleets because it can impact integrity and availability from a local low-privilege position. Internet exposure alone is not the main driver; risk rises where many users, containers, or shared workloads can reach the affected kernel paths.
Technical view
Overlayfs and Ubuntu shiftfs replace vma->vm_file during mmap handling. On an error path, the original value is not restored before reference release. With aufs changes to mmap_region() using vma_fput(), this can fput() vm_file and cause a reference count underflow. CVSS 3.1 is 7.1, local, low complexity, low privileges required.
Likely exposure
Exposure is most likely on Ubuntu systems running the affected 5.0 or 5.3 kernel series, especially where aufs, overlayfs, or shiftfs are present. The source bundle does not identify upstream Linux kernels as affected, and notes upstream behavior does not dereference vm_file after call_mmap() returns an error.
Exploitation context
The CVSS vector indicates local access and low privileges are required, with no user interaction. Integrity and availability impact are high, while confidentiality impact is none. The CVE is not marked as CISA KEV in the supplied bundle, and no cited source states active exploitation.
Researcher notes
The narrow trigger depends on interaction between overlayfs or Ubuntu shiftfs mmap handlers and aufs-modified mmap_region() cleanup. Evidence in the bundle supports affected Ubuntu 5.0 and 5.3 kernels only. Avoid broad Linux exposure claims unless confirmed by vendor advisories or package data.
Mitigation direction
- Apply Ubuntu kernel updates referenced by USN-4208-1 and USN-4209-1.
- Review the linked Ubuntu kernel commits for fix provenance.
- Prioritize hosts with local shell users or container workloads.
- Reboot into the updated kernel where required by Ubuntu guidance.
- If patch timing is constrained, follow Ubuntu vendor guidance for interim controls.
Validation and detection
- Inventory Ubuntu hosts running 5.0 or 5.3 kernel series.
- Check whether aufs, overlayfs, or shiftfs are in use.
- Compare installed kernel packages against USN-4208-1 and USN-4209-1.
- Confirm systems booted into a remediated kernel after updates.
- Document any unpatched hosts and compensating controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-672: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-15794 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H1.85.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635CVE reference · x_refsource_MISC
- https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3CVE reference · x_refsource_MISC
- https://usn.ubuntu.com/usn/usn-4208-1CVE reference · x_refsource_MISC
- https://usn.ubuntu.com/usn/usn-4209-1CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Operation on a Resource after Expiration or Release
Operation on a Resource after Expiration or Release represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.