Description
A memory leak in the i40e_setup_macvlans() function in drivers/net/ethernet/intel/i40e/i40e_main.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering i40e_setup_channel() failures, aka CID-27d461333459.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 5.4.19-1 | — |
| Debian 13 | linux | 5.4.19-1 | — |
| Debian 12 | linux | 5.4.19-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv +2 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +5 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-azure-5.3 | 5.3.0-1016.17~18.04.1 | USN-4300-1 |
| Ubuntu 18.04 LTS | linux-gcp-5.3 +1 | 5.3.0-1014.15~18.04.1 | USN-4300-1 |
| Ubuntu 18.04 LTS | linux-gcp-edge +2 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-hwe | 5.3.0-42.34~18.04.1 | USN-4300-1 |
| Ubuntu 18.04 LTS | linux-raspi2-5.3 | 5.3.0-1019.21~18.04.1 | USN-4300-1 |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Advisories 2
- USN-4300-1 linux, linux-aws, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-raspi2-5.3, linux-azure, linux-azure-5.3 vulnerabilities Ubuntu Security Notices (USN) · Jun 3, 2026
- WID-SEC-2023-0198 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Dec 9, 2025
References
- https://github.com/torvalds/linux/commit/27d461333459d282ffa4a2bdb6b215a59d493a8f
- FEDORA-2019-021c968423 vendor-advisory
- FEDORA-2019-34a75d7e61 vendor-advisory
- https://security.netapp.com/advisory/ntap-20191205-0001/
- USN-4300-1 vendor-advisory