CVE-2019-20054: In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/pro...

Security readout for executives and security teams

CVE-2019-20054 is a Linux kernel defect fixed before version 5.0.6. The public description identifies a NULL pointer dereference in proc sysctl cleanup logic. Business impact is most likely service disruption, but the source bundle does not provide CVSS, attack prerequisites, or confirmed exploitation. Exposure is plausible on Linux systems running kernels older than 5.0.6 or downstream vendor kernels that carried the affected proc_sysctl code. NetApp and openSUSE references indicate vendor tracking, but affected product detail is not present in the provided bundle. Handle through normal kernel patch governance unless asset inventory shows exposed critical systems on affected kernels. There is no provided evidence of active exploitation, but kernel availability issues can still disrupt production services. Mitigation focus: Check the running kernel version against vendor-supported fixed builds.; Prioritize upgrades to Linux kernel 5.0.6 or later where applicable.; Review downstream vendor advisories for backported fixes..

Prepared

Jun 6, 2026, 03:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.