--- id: CVE-2019-15217 title: An issue was discovered in the Linux kernel before 5.2.3 summary: >- An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver. severity: medium cvss: 4.6 cvssVector: 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-476 vendor: netapp product: active_iq_unified_manager affected: - linux_kernel < 5.2.3 - h410c_firmware - active_iq_unified_manager - data_availability_services - solidfire_&_hci_management_node - solidfire_baseboard_management_controller - ubuntu_linux = 14.04 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - ubuntu_linux = 19.04 - debian_linux = 8.0 - leap = 15.0 - leap = 15.1 patched: - linux_kernel 5.2.3 published: '2019-08-19' updated: '2026-10-08' sourceUpdated: '2026-10-08T21:17:14.607' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-15217' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2019/08/20/2' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2019/08/22/2' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2019/08/22/3' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2019/08/22/4' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2019/08/22/5' label: cve@mitre.org - url: 'https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3' label: cve@mitre.org - url: >- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d2e73a5f80a5b5aff3caf1ec6d39b5b3f54b26e label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20190905-0002/' label: cve@mitre.org - url: >- https://syzkaller.appspot.com/bug?id=9c0c178c24d828a7378f483309001329750aad64 label: cve@mitre.org - url: 'https://usn.ubuntu.com/4147-1/' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4286-1/' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4286-2/' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4302-1/' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2019/08/20/2' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2019/08/22/2' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2019/08/22/3' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2019/08/22/4' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2019/08/22/5' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d2e73a5f80a5b5aff3caf1ec6d39b5b3f54b26e label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20190905-0002/' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://syzkaller.appspot.com/bug?id=9c0c178c24d828a7378f483309001329750aad64 label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4147-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4286-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4286-2/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4302-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-15217.json - url: 'https://access.redhat.com/security/cve/CVE-2019-15217' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1745528' - url: 'https://www.cve.org/CVERecord?id=CVE-2019-15217' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-15217' - url: 'https://access.redhat.com/errata/RHSA-2020:4060' - url: 'https://access.redhat.com/errata/RHSA-2020:4062' tags: - nvd - csaf - vex - red-hat - cve.org epss: 0.0068 epssPercentile: 0.52188 ingestedAt: '2026-10-08T22:11:53.699Z' ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-10-08T21:01:13.374087Z' --- ## Overview An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver. ## Affected - `linux_kernel < 5.2.3` - `h410c_firmware` - `active_iq_unified_manager` - `data_availability_services` - `solidfire_&_hci_management_node` - `solidfire_baseboard_management_controller` - `ubuntu_linux = 14.04` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `ubuntu_linux = 19.04` - `debian_linux = 8.0` - `leap = 15.0` - `leap = 15.1` ## Remediation Upgrade past the affected range: - `linux_kernel 5.2.3` ## Vendor advisories - **RHSA-2020:4060** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Client Optional (v. 7), Red Hat Enterprise Linux ComputeNode (v. 7), Red Hat Enterprise Linux ComputeNode Optional (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux Server Optional (v. 7), … · released 2020-09-29 · [advisory](https://access.redhat.com/errata/RHSA-2020:4060) - **RHSA-2020:4062** · Red Hat · fixed in: Red Hat Enterprise Linux for Real Time for NFV (v. 7), Red Hat Enterprise Linux for Real Time (v. 7) · released 2020-09-29 · [advisory](https://access.redhat.com/errata/RHSA-2020:4062) - **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise MRG 2 · no fix planned: Red Hat Enterprise MRG 2, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · updated 2026-10-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-15217.json)