CVE-2019-19965: In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover....

Security readout for executives and security teams

CVE-2019-19965 is a Linux kernel flaw that can crash affected systems when SAS storage discovery races with a port disconnect. The sources describe a NULL pointer dereference, which usually maps to availability risk rather than data theft. Public evidence provided does not show active exploitation. Exposure is most relevant to Linux systems through kernel 5.4.6 where the libsas/SAS storage discovery path is present or used. Vendor advisories should be checked for exact downstream kernel package names and versions, because the CVE source bundle does not provide complete affected product/version metadata. Handle as a targeted kernel maintenance priority, not an emergency based on provided evidence. Raise urgency for storage-heavy systems, appliances, or environments where a host crash would materially disrupt operations. Mitigation focus: Update affected Linux kernel packages using vendor security advisories.; Prioritize systems using SAS storage or libsas-capable kernel configurations.; Check Debian, Ubuntu, openSUSE, and NetApp guidance where applicable..

Prepared

Jun 6, 2026, 03:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.