CVE-2019-19813

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in __mutex_lock in kernel/locking/mutex.c. This is related to mutex_can_spin_on_owner in kernel/locking/mutex.c, __btrfs_qgroup_free_meta in fs/btrfs/qgroup.c, and btrfs_insert_delayed_items in fs/btrfs/delayed-inode.c.

• CWE-416

• https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19813Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200103-0001/Third Party Advisory
• https://usn.ubuntu.com/4414-1/Third Party Advisory
• https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19813Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200103-0001/Third Party Advisory
• https://usn.ubuntu.com/4414-1/Third Party Advisory

Published

Dec 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19802In Gallagher Command Centre Server v8.10 prior to v8.10.1134…6.5
• CVE-2019-19805_account_forgot_password.ajax.php in MFScripts YetiShare 3.5…5.3
• CVE-2019-19806_account_forgot_password.ajax.php in MFScripts YetiShare 3.5…5.3
• CVE-2019-19807In the Linux kernel before 5.3.11, sound/core/timer.c has a …7.8
• CVE-2019-1981A vulnerability in the normalization functionality of Cisco …5.8
• CVE-2019-19810Zoom Call Recording 6.3.1 from Eleveo is vulnerable to Java …10
• CVE-2019-19814In the Linux kernel 5.0.21, mounting a crafted f2fs filesyst…7.8
• CVE-2019-19815In the Linux kernel 5.0.21, mounting a crafted f2fs filesyst…5.5
• CVE-2019-19816In the Linux kernel 5.0.21, mounting a crafted btrfs filesys…7.8
• CVE-2019-19817The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader…5.5
• CVE-2019-19818The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader…5.5
• CVE-2019-19819The JBIG2Globals library in npdf.dll in Nitro Free PDF Reade…5.5