---
id: CVE-2019-15807
title: >-
  In the Linux kernel before 5.1.13, there is a memory leak in
  drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails
summary: >-
  In the Linux kernel before 5.1.13, there is a memory leak in
  drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails. This
  will cause a BUG and denial of service.
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-401
  - CWE-400
vendor: linux
product: linux_kernel
affected:
  - linux_kernel < 5.1.13
  - debian_linux = 8.0
  - enterprise_linux = 7.0
  - enterprise_linux = 8.0
patched:
  - linux_kernel 5.1.13
published: '2019-08-29'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T21:17:15.417'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-15807'
references:
  - url: 'https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.13'
    label: cve@mitre.org
  - url: >-
      https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3b0541791453fbe7f42867e310e0c9eb6295364d
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2019/09/msg00014.html'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2019/09/msg00015.html'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html'
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20191004-0001/'
    label: cve@mitre.org
  - url: >-
      https://support.f5.com/csp/article/K52136304?utm_source=f5support&amp%3Butm_medium=RSS
    label: cve@mitre.org
  - url: 'https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.13'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3b0541791453fbe7f42867e310e0c9eb6295364d
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2019/09/msg00014.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2019/09/msg00015.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20191004-0001/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://support.f5.com/csp/article/K52136304?utm_source=f5support&amp%3Butm_medium=RSS
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-15807.json
  - url: 'https://access.redhat.com/security/cve/CVE-2019-15807'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1747216'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2019-15807'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-15807'
  - url: 'https://access.redhat.com/errata/RHSA-2020:4060'
  - url: 'https://access.redhat.com/errata/RHSA-2020:4062'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00405
epssPercentile: 0.34598
ingestedAt: '2026-10-08T22:11:53.700Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T21:00:05.574858Z'
---

## Overview

In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails. This will cause a BUG and denial of service.

## Affected

- `linux_kernel < 5.1.13`
- `debian_linux = 8.0`
- `enterprise_linux = 7.0`
- `enterprise_linux = 8.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 5.1.13`

## Vendor advisories

- **RHSA-2020:4060** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Client Optional (v. 7), Red Hat Enterprise Linux ComputeNode (v. 7), Red Hat Enterprise Linux ComputeNode Optional (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux Server Optional (v. 7), … · released 2020-09-29 · [advisory](https://access.redhat.com/errata/RHSA-2020:4060)
- **RHSA-2020:4062** · Red Hat · fixed in: Red Hat Enterprise Linux for Real Time for NFV (v. 7), Red Hat Enterprise Linux for Real Time (v. 7) · released 2020-09-29 · [advisory](https://access.redhat.com/errata/RHSA-2020:4062)
- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise MRG 2 · no fix planned: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise MRG 2, Red Hat Enterprise Linux 7, … · updated 2026-10-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-15807.json)