CVE-2019-14763 — Improper Locking in Kernel

CWE-667 — Improper LockingCWE-833 — DeadlockCWE-327 — Use of a Broken or Risky Cryptographic Algorithm14 documents8 sources
Severity
5.5MEDIUMNVD
OSV4.6OSV3.3
EPSS
0.1%
top 80.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Linux KernelDebian LinuxCanonical Ubuntu Linux
Timeline
PublishedAug 7
Latest updateDec 18

Description

In the Linux kernel before 4.16.4, a double-locking error in drivers/usb/dwc3/gadget.c may potentially cause a deadlock with f_hid.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶NVDlinux/linux_kernel< 4.16.4
▶Debianlinux/linux_kernel< 4.16.5-1+3
▶Ubuntulinux/linux_kernel< 4.15.0-62.69+1
▶debiandebian/linux< linux 4.16.5-1 (bookworm)

Also affects: Ubuntu Linux 16.04, 18.04

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: github.com ↗

🔴Vulnerability Details

6
GHSA
Amazon S3 Encryption Client for Java has a Key Commitment Issue↗2025-12-18
▶
GHSA
GHSA-rq2w-c7m2-92hw: In the Linux kernel before 4↗2022-05-24
▶
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2 regression↗2019-09-11
▶
OSV
linux, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2 vulnerabilities↗2019-09-02
▶
OSV
linux-aws vulnerabilities↗2019-09-02
▶

📋Vendor Advisories

5
Ubuntu
Linux kernel regression↗2019-09-11
▶
Ubuntu
Linux kernel (AWS) vulnerabilities↗2019-09-02
▶
Ubuntu
Linux kernel vulnerabilities↗2019-09-02
▶
Red Hat
kernel: double-locking error in drivers/usb/dwc3/gadget.c leads to denial of service↗2019-08-07
▶
Debian
CVE-2019-14763: linux - In the Linux kernel before 4.16.4, a double-locking error in drivers/usb/dwc3/ga...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-14763 kernel: double-locking error in drivers/usb/dwc3/gadget.c leads to denial of service↗2019-08-20
▶
Bugzilla
CVE-2019-14763 kernel: double-locking error in drivers/usb/dwc3/gadget.c leads to denial of service [fedora-all]↗2019-08-20
▶