LiveActive security incident?Get immediate response
CVE Record

CVE-2019-15807: In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS ex...

In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails. This will cause a BUG and denial of service.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2019-15807 is a Linux kernel denial-of-service issue. On kernels before 5.1.13, a failed SAS expander discovery can leak memory and trigger a kernel BUG, potentially crashing affected systems. Business risk is highest for servers or appliances using SAS storage paths.

Executive priority

Treat this as a targeted infrastructure reliability risk, not an internet-wide emergency based on the supplied evidence. Patch through normal kernel and appliance maintenance, with higher priority for storage-heavy servers where an unexpected kernel BUG could disrupt business services.

Technical view

The flaw is in drivers/scsi/libsas/sas_expander.c. The source states that failed SAS expander discovery can leak memory and cause a BUG. The upstream Linux fix is referenced in the 5.1.13 changelog and a kernel commit. Debian LTS, NetApp, and F5 advisories indicate downstream vendor impact tracking.

Likely exposure

Likely exposure is limited to Linux systems or downstream products running affected kernels before 5.1.13 where SAS expander discovery through libsas is relevant. The source bundle does not provide a complete affected-product matrix or CVSS vector.

Exploitation context

No source in the bundle states active exploitation, and KEV is false. The described trigger is SAS expander discovery failure. The bundle does not describe attacker prerequisites, remote reachability, or a public exploit, so exploitation conditions remain unclear.

Researcher notes

The key evidence is the upstream Linux commit and 5.1.13 changelog. CVSS, CWE, and detailed affected CPE data are absent from the bundle. Avoid assuming remote exploitability; focus validation on kernel lineage, libsas exposure, and vendor backports.

Mitigation direction

  • Upgrade to Linux kernel 5.1.13 or a vendor-fixed kernel build.
  • Apply relevant Debian LTS linux updates if using affected Debian releases.
  • Check NetApp and F5 advisories for product-specific applicability.
  • Prioritize systems using SAS expanders or storage appliances first.
  • Schedule reboot validation where kernel package updates require activation.

Validation and detection

  • Inventory active kernel versions, not only installed packages.
  • Identify hosts using SAS hardware, libsas, or SAS expanders.
  • Confirm vendor appliance firmware or OS advisory status.
  • After patching, verify the running kernel includes the fix.
  • Review kernel logs for SAS discovery failures or BUG events.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-15807 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
8Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.