CVE-2019-15099 is a NULL pointer dereference vulnerability in the ath10k USB driver (drivers/net/wireless/ath/ath10k/usb.c) of the Linux kernel, affecting versions up to 5.2.8, including Canonical and Ubuntu Linux distributions. This flaw, triggered by an incomplete address in an endpoint descriptor, carries a CVSS v3.1 score of 7.5 (HIGH), indicating a network-exploitable vulnerability with low attack complexity that can lead to a complete denial of service. While no public exploit code or active exploitation has been observed, and it's not listed in CISA's KEV catalog, it has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.14, < 4.14.157CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.15, < 4.19.87CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.20, < 5.3.14CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.4.0, < 5.4.1CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
14.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.