CVE-2019-19922

kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)

• CWE-400

• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.9Mailing List, Patch, Vendor Advisory
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=de53fd7aedb100f03e5d2231cfce0e4993282425Mailing List, Patch, Vendor Advisory
• https://github.com/kubernetes/kubernetes/issues/67577Issue Tracking, Patch, Third Party Advisory
• https://github.com/torvalds/linux/commit/de53fd7aedb100f03e5d2231cfce0e4993282425Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/01/msg00013.htmlMailing List, Third Party Advisory
• https://relistan.com/the-kernel-may-be-slowing-down-your-appExploit, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200204-0002/Third Party Advisory
• https://usn.ubuntu.com/4226-1/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.9Mailing List, Patch, Vendor Advisory
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=de53fd7aedb100f03e5d2231cfce0e4993282425Mailing List, Patch, Vendor Advisory
• https://github.com/kubernetes/kubernetes/issues/67577Issue Tracking, Patch, Third Party Advisory
• https://github.com/torvalds/linux/commit/de53fd7aedb100f03e5d2231cfce0e4993282425Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/01/msg00013.htmlMailing List, Third Party Advisory
• https://relistan.com/the-kernel-may-be-slowing-down-your-appExploit, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200204-0002/Third Party Advisory
• https://usn.ubuntu.com/4226-1/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory

Published

Dec 22, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19917Lout 3.40 has a buffer overflow in the StringQuotedWord() fu…7.8
• CVE-2019-19918Lout 3.40 has a heap-based buffer overflow in the srcnext() …7.8
• CVE-2019-19919Versions of handlebars prior to 4.3.0 are vulnerable to Prot…9.8
• CVE-2019-1992In bta_hl_sdp_query_results of bta_hl_main.cc, there is a po…
• CVE-2019-19920sa-exim 4.2.1 allows attackers to execute arbitrary code if …8.8
• CVE-2019-19921runc through 1.0.0-rc9 has Incorrect Access Control leading …7
• CVE-2019-19923flattenSubquery in select.c in SQLite 3.30.1 mishandles cert…7.5
• CVE-2019-19924SQLite 3.30.1 mishandles certain parser-tree rewriting, rela…5.3
• CVE-2019-19925zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishand…7.5
• CVE-2019-19926multiSelect in select.c in SQLite 3.30.1 mishandles certain …7.5
• CVE-2019-19927In the Linux kernel 5.0.0-rc7 (as distributed in ubuntu/linu…6
• CVE-2019-19929An Untrusted Search Path vulnerability in Malwarebytes AdwCl…7.8