CISA KEV High exploit reference

CVE-2019-13272 — Linux Kernel Improper Privilege Management Vulnerability

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

Published Jul 17, 2019 · Updated Oct 13, 2026 · Sources: CISA Known Exploited Vulnerabilities, CVE Program (cve.org) e CISA ADP, NIST National Vulnerability Database, GitHub Security Advisories · CNA: mitre

Urgent

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

CISA KEV · Dec 10, 2021 Metasploit modules · 1 Exploit-DB · 4

How the score was calculated

Confirmed exploitation (CISA KEV)+35
Public exploit/PoC (metasploit, exploitdb)+20
EPSS 52.2% (30-day exploitation probability)+15
Technical severity (high)+6

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Confirmed

CISA KEV, listed Dec 10, 2021

EPSS FIRST

52.2%

ahead of 99% of scored CVEs · Oct 14, 2026

Affects

Canonical

Ubuntu Linux and 21 more

CVSS base

7.8

High · 4 source(s)

CISA SSVC assessment CISA

Three decision points CISA publishes for the CVEs it assesses (SSVC 2.0.3). A stakeholder decision, not a severity score.

Exploitation

Active

none · proof-of-concept · active

Automatable

can an attacker script the kill-chain steps

Technical impact

Total

partial · total control of the vulnerable component

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

Documented patch — bugs.chromium.org (NIST National Vulnerability Database)
Documented patch — bugzilla.redhat.com (NIST National Vulnerability Database)
Documented patch — bugzilla.suse.com (NIST National Vulnerability Database)
Documented patch — cdn.kernel.org (NIST National Vulnerability Database)
Documented patch — git.kernel.org (NIST National Vulnerability Database)
Documented patch — github.com (NIST National Vulnerability Database)

CISA required action CISA

Apply updates per vendor instructions.

US federal deadline: Jun 10, 2022 — passed 1588 day(s) ago

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora…).
Treat as emergency remediation: the CVE is in CISA KEV (confirmed exploitation).
Apply the fixed version or the patch documented under Remediation.
EPSS ahead of 99% of scored CVEs: prioritize it in the patch queue.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Canonical	Ubuntu Linux	version 16.04version 18.04version 19.04	Vulnerable	NIST National Vulnerability Database
Debian	Debian Linux	version 8.0version 9.0version 10.0	Vulnerable	NIST National Vulnerability Database
Fedoraproject	Fedora	version 29	Vulnerable	NIST National Vulnerability Database
Linux	Linux Kernel	≥ 4.4.40 and < 4.4.185≥ 4.20 and < 5.1.17≥ 4.15 and < 4.19.58≥ 4.10 and < 4.14.133≥ 4.9.1 and < 4.9.185≥ 4.8.16 and < 4.9≥ 4.1.39 and < 4.2≥ 3.16.52 and < 3.16.71	Vulnerable	NIST National Vulnerability Database
Netapp	Active Iq Unified Manager	versions not specified by the source	Vulnerable	NIST National Vulnerability Database
Netapp	Aff A700s Firmware	versions not specified by the source	Vulnerable	NIST National Vulnerability Database
Netapp	E-series Performance Analyzer	versions not specified by the source	Vulnerable	NIST National Vulnerability Database
Netapp	E-series Santricity Os Controller	≥ 11.0.0 and ≤ 11.60.3	Vulnerable	NIST National Vulnerability Database
Netapp	H410c Firmware	versions not specified by the source	Vulnerable	NIST National Vulnerability Database
Netapp	H610s Firmware	versions not specified by the source	Vulnerable	NIST National Vulnerability Database
Netapp	Hci Compute Node	versions not specified by the source	Vulnerable	NIST National Vulnerability Database
Netapp	Hci Management Node	versions not specified by the source	Vulnerable	NIST National Vulnerability Database
Netapp	Service Processor	versions not specified by the source	Vulnerable	NIST National Vulnerability Database
Netapp	Solidfire	versions not specified by the source	Vulnerable	NIST National Vulnerability Database
Netapp	Steelstore Cloud Integrated Storage	versions not specified by the source	Vulnerable	NIST National Vulnerability Database
Red Hat	Enterprise Linux	version 7.0version 8.0	Vulnerable	NIST National Vulnerability Database
Red Hat	Enterprise Linux For Arm 64	version 7.0_aarch64	Vulnerable	NIST National Vulnerability Database
Red Hat	Enterprise Linux For Ibm Z Systems	version 7.0_s390x	Vulnerable	NIST National Vulnerability Database
Red Hat	Enterprise Linux For Real Time	version 8	Vulnerable	NIST National Vulnerability Database
Red Hat	Enterprise Linux For Real Time For Nfv	version 8.0	Vulnerable	NIST National Vulnerability Database
Red Hat	Enterprise Linux For Real Time For Nfv Tus	version 8.8version 8.6version 8.4version 8.2	Vulnerable	NIST National Vulnerability Database
Red Hat	Enterprise Linux For Real Time Tus	version 8.8version 8.6version 8.4version 8.2	Vulnerable	NIST National Vulnerability Database

Attack characteristics

The CVSS vector, decoded. It describes the attack, not your exposure to it.

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Every base score collected

Sources score independently and may disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Scored by
7.8	CVSS 3.1	High	1.8	5.9	nvd@nist.gov via NIST National Vulnerability Database
7.8	CVSS 3.1	High	1.8	5.9	134c704f-9b21-4f2e-91b3-4a467353bcc0 via NIST National Vulnerability Database
7.8	CVSS 3.1	High	—	—	GitHub, Inc. via GitHub Security Advisories
7.8	CVSS 3.1	High	—	—	CISA-ADP via CVE Program (cve.org) e CISA ADP
7.2	CVSS 2.0	High	3.9	10.0	nvd@nist.gov via NIST National Vulnerability Database

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (score shown at the top: nvd@nist.gov)

CISA KEV details CISA

CISA lists a CVE once it has evidence of exploitation against real targets.

Listed

Dec 10, 2021

Federal deadline

Jun 10, 2022

passed 1588 day(s) ago

Ransomware use

Unknown

CISA records ransomware use only for campaigns it has confirmed, so “Unknown” means unrecorded, not ruled out. The deadline binds US federal agencies; for everyone else it is a reference date.

Public exploits, PoCs and detection templates

Public code that demonstrates or tests the flaw raises the odds of mass exploitation — and Nuclei templates help find vulnerable assets in your environment.

Metasploit modules

Linux Polkit pkexec helper PTRACE_TRACEME local root exploit excellent Jul 4, 2019

Exploit-DB

Linux - Broken Permission and Object Lifetime Handling for PTRACE_TRACEME verified Jul 17, 2019
Linux Kernel 4.10 < 5.1.17 - 'PTRACE_TRACEME' pkexec Local Privilege Escalation Jul 24, 2019
Linux Polkit - pkexec helper PTRACE_TRACEME local root (Metasploit) verified Oct 24, 2019
Linux Kernel 5.1.x - 'PTRACE_TRACEME' pkexec Local Privilege Escalation (2) Nov 23, 2021

Warning: public PoCs are sometimes disguised malware. Use them only for authorized testing in an isolated environment. This portal does not host exploit code — it only points to the sources.

EPSS over time FIRST

Oct 13, 2026 → Oct 14, 2026 · 2 reading(s) · max 52.20%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Local/physical vector: focus on endpoint telemetry (EDR) from affected hosts.
Hunt retroactively in logs from before Dec 10, 2021 (KEV listing): exploitation may have started earlier.

endpoint telemetry (EDR)

Timeline

What happened to this CVE, newest first.

2026
Fix documented
Oct 13, 2026 · NIST National Vulnerability Database
Affected products added · linux/linux kernel, debian/debian linux, fedoraproject/fedora, canonical/ubuntu linux, redhat/enterprise linux, redhat/e
Oct 13, 2026 · NIST National Vulnerability Database
Source status changed · Published → Analyzed
Oct 13, 2026 · NIST National Vulnerability Database
Record published
Oct 13, 2026
CVSS changed · 7.8
Oct 13, 2026 · CVE Program (cve.org) e CISA ADP
Source status changed · → Published
Oct 13, 2026 · CVE Program (cve.org) e CISA ADP
SSVC assessment updated
Oct 13, 2026 · CVE Program (cve.org) e CISA ADP
Added to CISA KEV (detected)
Oct 13, 2026 · CISA Known Exploited Vulnerabilities
Record created in this database
Oct 13, 2026 · CISA Known Exploited Vulnerabilities
2021
Added to CISA KEV catalog
Dec 9, 2021 · CISA
2019
CVE published
Jul 17, 2019 · mitre

Source activity

Repeated readings are counted rather than listed.

3× References added · Oct 13, 2026 – Oct 13, 2026
1× Official description updated · Oct 13, 2026 – Oct 13, 2026

References

41 on the record

bugzilla.redhat.com/show_bug.cgi
x_refsource_CONFIRM, Issue Tracking, Patch, CVE Program (cve.org) e CISA ADP
github.com/torvalds/linux/commit/6994eefb0053799d2e07cd140df6c2ea106c41ee
x_refsource_MISC, Patch, CVE Program (cve.org) e CISA ADP
cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.17
x_refsource_MISC, Patch, Vendor Advisory, CVE Program (cve.org) e CISA ADP
bugs.chromium.org/p/project-zero/issues/detail
x_refsource_MISC, Exploit, Issue Tracking, Patch, Third Party Advisory, CVE Program (cve.org) e CISA ADP
git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/
x_refsource_MISC, Patch, Vendor Advisory, CVE Program (cve.org) e CISA ADP
bugzilla.suse.com/show_bug.cgi
x_refsource_CONFIRM, Issue Tracking, Patch, Third Party Advisory, CVE Program (cve.org) e CISA ADP
www.cisa.gov/known-exploited-vulnerabilities-catalog
US Government Resource, NIST National Vulnerability Database
www.debian.org/security/2019/dsa-4484
vendor-advisory, x_refsource_DEBIAN, Third Party Advisory, CVE Program (cve.org) e CISA ADP
packetstormsecurity.com/files/153663/Linux-PTRACE_TRACEME-Broken-Permission-Object-Lifetime-H
x_refsource_MISC, Third Party Advisory, VDB Entry, CVE Program (cve.org) e CISA ADP
packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Update
x_refsource_MISC, Third Party Advisory, VDB Entry, CVE Program (cve.org) e CISA ADP
usn.ubuntu.com/4093-1
GitHub Security Advisories
usn.ubuntu.com/4118-1
GitHub Security Advisories
usn.ubuntu.com/4095-1
GitHub Security Advisories
access.redhat.com/errata/RHSA-2019:2809
vendor-advisory, x_refsource_REDHAT, Third Party Advisory, CVE Program (cve.org) e CISA ADP
access.redhat.com/errata/RHSA-2019:2405
vendor-advisory, x_refsource_REDHAT, Third Party Advisory, CVE Program (cve.org) e CISA ADP
lists.debian.org/debian-lts-announce/2019/07/msg00022.html
mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory, CVE Program (cve.org) e CISA ADP
packetstormsecurity.com/files/156929/Linux-PTRACE_TRACEME-Local-Root.html
x_refsource_MISC, Exploit, Third Party Advisory, VDB Entry, CVE Program (cve.org) e CISA ADP
support.f5.com/csp/article/K91025336
x_refsource_CONFIRM, Third Party Advisory, CVE Program (cve.org) e CISA ADP
access.redhat.com/errata/RHSA-2019:2411
vendor-advisory, x_refsource_REDHAT, Third Party Advisory, CVE Program (cve.org) e CISA ADP
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGRK5L
GitHub Security Advisories
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGRK
GitHub Security Advisories
usn.ubuntu.com/4118-1/
vendor-advisory, x_refsource_UBUNTU, Third Party Advisory, CVE Program (cve.org) e CISA ADP
security.netapp.com/advisory/ntap-20190806-0001
GitHub Security Advisories
seclists.org/bugtraq/2019/Jul/30
mailing-list, x_refsource_BUGTRAQ, Issue Tracking, Mailing List, Third Party Advisory, CVE Program (cve.org) e CISA ADP
github.com/advisories/GHSA-87j5-gppq-mq6h
GitHub Security Advisories
support.f5.com/csp/article/K91025336
GitHub Security Advisories
security.netapp.com/advisory/ntap-20190806-0001/
x_refsource_CONFIRM, Third Party Advisory, CVE Program (cve.org) e CISA ADP
usn.ubuntu.com/4093-1/
vendor-advisory, x_refsource_UBUNTU, Third Party Advisory, CVE Program (cve.org) e CISA ADP
support.f5.com/csp/article/K91025336
x_refsource_CONFIRM, Third Party Advisory, CVE Program (cve.org) e CISA ADP
lists.debian.org/debian-lts-announce/2019/07/msg00023.html
mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory, CVE Program (cve.org) e CISA ADP
usn.ubuntu.com/4095-1/
vendor-advisory, x_refsource_UBUNTU, Third Party Advisory, CVE Program (cve.org) e CISA ADP
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGRK
vendor-advisory, x_refsource_FEDORA, Release Notes, CVE Program (cve.org) e CISA ADP
nvd.nist.gov/vuln/detail/CVE-2019-13272
GitHub Security Advisories
seclists.org/bugtraq/2019/Jul/33
mailing-list, x_refsource_BUGTRAQ, Issue Tracking, Mailing List, Third Party Advisory, CVE Program (cve.org) e CISA ADP
packetstormsecurity.com/files/165051/Linux-Kernel-5.1.x-PTRACE_TRACEME-pkexec-Local-Privilege
x_refsource_MISC, Exploit, Third Party Advisory, VDB Entry, CVE Program (cve.org) e CISA ADP
usn.ubuntu.com/4117-1
GitHub Security Advisories
usn.ubuntu.com/4094-1
GitHub Security Advisories
usn.ubuntu.com/4117-1/
vendor-advisory, x_refsource_UBUNTU, Third Party Advisory, CVE Program (cve.org) e CISA ADP
packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html
x_refsource_MISC, Exploit, Third Party Advisory, VDB Entry, CVE Program (cve.org) e CISA ADP
packetstormsecurity.com/files/154957/Linux-Polkit-pkexec-Helper-PTRACE_TRACEME-Local-Root.htm
x_refsource_MISC, Exploit, Third Party Advisory, VDB Entry, CVE Program (cve.org) e CISA ADP
usn.ubuntu.com/4094-1/
vendor-advisory, x_refsource_UBUNTU, Third Party Advisory, CVE Program (cve.org) e CISA ADP

Elsewhere on this site

Canonical
every CVE for this vendor

2021-12
what else CISA listed that month

Related CVEs (same products)

Medium CVE-2026-104045 Sssd: sssd: denial of service via race condition in autofs responder 9d
Medium CVE-2026-104046 Sssd: sssd: denial of service via incomplete identity provider authentication requests 9d
High CVE-2026-104048 Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation 9d
Medium CVE-2026-104047 Sssd: sssd: information disclosure via query injection in entra id lookups 9d
High CVE-2026-102558 Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth 16d
High CVE-2026-102555 Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding 16d

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2019-13272 is "Linux Kernel Improper Privilege Management Vulnerability", rated High. It affects Ubuntu Linux (Canonical); versions are in the scope table. It is in CISA KEV: there is evidence of real-world exploitation. CVSS 7.8 describes technical severity. EPSS 52.20% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.