CVE-2019-11478
HighJonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences.
Published Jun 19, 2019 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2019-11478, SUSE-SU-2019:1888-1, SUSE-SU-2019:1935-1, UBUNTU-CVE-2019-11478
Key Facts
Patch immediately- CVE-2019-11478 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Big-Ip Access Policy Manager (F5), Big-Ip Advanced Firewall Manager (F5), Big-Ip Analytics (F5) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 95% probability of exploitation in the next 30 days.
- Fixed versions are available, including bpftool 3.10.0-957.21.3.el7, bpftool 4.18.0-80.4.2.el8_0, cluster-md-kmp-default 4.12.14-150.22.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
95%
Higher than 99.8% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2019-11478 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.
Affected Products
817 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Big-Ip Access Policy ManagerF5 | 15.0.0 | 11.6.4 |
| Big-Ip Advanced Firewall ManagerF5 | 15.0.0 | 11.6.4 |
| Big-Ip AnalyticsF5 | 15.0.0 | 11.6.4 |
| Big-Ip Application Acceleration ManagerF5 | 15.0.0 | 11.6.4 |
| Big-Ip Application Security ManagerF5 | 15.0.0 | 11.6.4 |
Patched Releases
bpftool
3.10.0-957.21.3.el7, 4.18.0-80.4.2.el8_0
cluster-md-kmp-default
4.12.14-150.22.1, 4.12.14-150.27.1, 4.12.14-197.4.1, 4.12.14-95.19.1, 4.12.14-95.24.1, 4.4.121-92.114.1, 4.4.180-94.97.1
cluster-md-kmp-rt
4.12.14-14.8.1, 4.12.14-8.3.1
cluster-network-kmp-default
4.4.121-92.114.1
dlm-kmp-default
4.12.14-150.22.1, 4.12.14-150.27.1, 4.12.14-197.4.1, 4.12.14-95.19.1, 4.12.14-95.24.1, 4.4.121-92.114.1, 4.4.180-94.97.1
dlm-kmp-rt
4.12.14-14.8.1, 4.12.14-8.3.1
dtrace-modules-3.8.13-118.35.2.el6uek
0.4.5-3.el6
dtrace-modules-3.8.13-118.35.2.el7uek
0.4.5-3.el7
Big-Ip Access Policy Manager
<=11.6.4
Big-Ip Advanced Firewall Manager
<=11.6.4
Big-Ip Analytics
<=11.6.4
Big-Ip Application Acceleration Manager
<=11.6.4
Big-Ip Application Security Manager
<=11.6.4
Big-Ip Domain Name System
<=11.6.4
Big-Ip Edge Gateway
<=11.6.4
Big-Ip Fraud Protection Service
<=11.6.4
Big-Ip Global Traffic Manager
<=11.6.4
Big-Ip Link Controller
<=11.6.4
Big-Ip Local Traffic Manager
<=11.6.4
Big-Ip Policy Enforcement Manager
<=11.6.4
Big-Ip Webaccelerator
<=11.6.4
Traffix Signaling Delivery Controller
<=5.1.0
gfs2-kmp-default
4.12.14-150.22.1, 4.12.14-150.27.1, 4.12.14-197.4.1, 4.12.14-95.19.1, 4.12.14-95.24.1, 4.4.121-92.114.1, 4.4.180-94.97.1
gfs2-kmp-rt
4.12.14-14.8.1, 4.12.14-8.3.1
kernel
0:2.6.32-504.79.3.el6, 0:3.10.0-862.34.2.el7, 0:4.18.0-80.4.2.el8_0, 2.6.32-754.15.3.el6, 3.10.0-957.21.3.el7, 4.14.123-111.109.amzn2, 4.14.123-86.109.amzn1, 4.18.0-80.4.2.el8_0
Timeline
Publicly disclosed
Jun 19, 2019
Last updated
Aug 4, 2026
Weakness Type
- CWE-400 Uncontrolled Resource Consumption
- CWE-770 Allocation of Resources Without Limits or Throttling
References
- advisoryhttp://packetstormsecurity.com/files/153346/Kernel-Live-Patch-Security-Notice-LSN-0052-1.html
- advisoryRHSA-2019:1479
- advisoryRHSA-2019:1480
- advisoryRHSA-2019:1481
- advisoryRHSA-2019:1482
FAQ
Common Questions.
Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences.
Affected: Big-Ip Access Policy Manager (F5) versions 15.0.0; Big-Ip Advanced Firewall Manager (F5) versions 15.0.0; Big-Ip Analytics (F5) versions 15.0.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including bpftool 3.10.0-957.21.3.el7, bpftool 4.18.0-80.4.2.el8_0, cluster-md-kmp-default 4.12.14-150.22.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2019-11478 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo