High 7.8Known exploited (CISA KEV)Published Jul 17, 2019

CVE-2019-13272In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obta…

Updated under an hour ago (2026-10-19 11:20 UTC)

Does this affect you?

It affects linux_kernel and 21 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Dec 10, 2021; federal agencies had to remediate by Jun 10, 2022. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for linux_kernel

Exploited in the last 30 days

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

CVSS: 7.8 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Added to CISA KEV Dec 10, 2021; federal remediation due Jun 10, 2022Apply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 52.20% (percentile 99)
Assigned by: mitre
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

linux linux_kernel linux:linux_kernel	from 3.16.52 before 3.16.71; from 4.1.39 before 4.2; from 4.4.40 before 4.4.185; from 4.8.16 before 4.9; from 4.9.1 before 4.9.185; from 4.10 before 4.14.133; from 4.15 before 4.19.58; from 4.20 before 5.1.17	NVD
debian debian_linux debian:debian_linux	8.0; 9.0; 10.0	NVD
fedoraproject fedora fedoraproject:fedora	29	NVD
canonical ubuntu_linux canonical:ubuntu_linux	16.04; 18.04; 19.04	NVD
redhat enterprise_linux redhat:enterprise_linux	7.0; 8.0	NVD
redhat enterprise_linux_for_arm_64 redhat:enterprise_linux_for_arm_64	7.0_aarch64	NVD
redhat enterprise_linux_for_ibm_z_systems redhat:enterprise_linux_for_ibm_z_systems	7.0_s390x	NVD
redhat enterprise_linux_for_real_time redhat:enterprise_linux_for_real_time	8	NVD
redhat enterprise_linux_for_real_time_for_nfv redhat:enterprise_linux_for_real_time_for_nfv	8.0	NVD
redhat enterprise_linux_for_real_time_for_nfv_tus redhat:enterprise_linux_for_real_time_for_nfv_tus	8.2; 8.4; 8.6; 8.8	NVD
redhat enterprise_linux_for_real_time_tus redhat:enterprise_linux_for_real_time_tus	8.2; 8.4; 8.6; 8.8	NVD
netapp aff_a700s_firmware netapp:aff_a700s_firmware	all versions	NVD
netapp h410c_firmware netapp:h410c_firmware	all versions	NVD
netapp h610s_firmware netapp:h610s_firmware	all versions	NVD
netapp active_iq_unified_manager netapp:active_iq_unified_manager	all versions	NVD
netapp e-series_performance_analyzer netapp:e-series_performance_analyzer	all versions	NVD
netapp e-series_santricity_os_controller netapp:e-series_santricity_os_controller	from 11.0.0 through 11.60.3	NVD
netapp hci_management_node netapp:hci_management_node	all versions	NVD
netapp service_processor netapp:service_processor	all versions	NVD
netapp solidfire netapp:solidfire	all versions	NVD
netapp steelstore_cloud_integrated_storage netapp:steelstore_cloud_integrated_storage	all versions	NVD
netapp hci_compute_node netapp:hci_compute_node	all versions	NVD

References

http://packetstormsecurity.com/files/153663/Linux-PTRACE_TRACEME-Broken-Permission-Object-Lifetime-Handling.htmlx-refsource-misc, third-party-advisory, vdb-entry
https://bugs.chromium.org/p/project-zero/issues/detail?id=1903x-refsource-misc, exploit, issue-tracking, patch, third-party-advisory
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.17x-refsource-misc, patch, vendor-advisory
https://github.com/torvalds/linux/commit/6994eefb0053799d2e07cd140df6c2ea106c41eex-refsource-misc, patch
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6994eefb0053799d2e07cd140df6c2ea106c41eex-refsource-misc, patch, vendor-advisory
https://bugzilla.suse.com/show_bug.cgi?id=1140671x-refsource-confirm, issue-tracking, patch, third-party-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1730895x-refsource-confirm, issue-tracking, patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGRK5LYWBJ4E4SRI4DKX367NHYSI3VOH/vendor-advisory, x-refsource-fedora, release-notes
https://www.debian.org/security/2019/dsa-4484vendor-advisory, x-refsource-debian
https://seclists.org/bugtraq/2019/Jul/30mailing-list, x-refsource-bugtraq, issue-tracking, third-party-advisory
https://seclists.org/bugtraq/2019/Jul/33mailing-list, x-refsource-bugtraq, issue-tracking, third-party-advisory
https://lists.debian.org/debian-lts-announce/2019/07/msg00022.htmlmailing-list, x-refsource-mlist, third-party-advisory
https://lists.debian.org/debian-lts-announce/2019/07/msg00023.htmlmailing-list, x-refsource-mlist, third-party-advisory
http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlx-refsource-misc, third-party-advisory, vdb-entry
https://security.netapp.com/advisory/ntap-20190806-0001/x-refsource-confirm, third-party-advisory
https://access.redhat.com/errata/RHSA-2019:2405vendor-advisory, x-refsource-redhat, third-party-advisory
https://access.redhat.com/errata/RHSA-2019:2411vendor-advisory, x-refsource-redhat, third-party-advisory
https://usn.ubuntu.com/4093-1/vendor-advisory, x-refsource-ubuntu, third-party-advisory
https://usn.ubuntu.com/4094-1/vendor-advisory, x-refsource-ubuntu, third-party-advisory
https://usn.ubuntu.com/4095-1/vendor-advisory, x-refsource-ubuntu
http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.htmlx-refsource-misc, exploit, third-party-advisory, vdb-entry
https://support.f5.com/csp/article/K91025336x-refsource-confirm, third-party-advisory
https://usn.ubuntu.com/4117-1/vendor-advisory, x-refsource-ubuntu
https://usn.ubuntu.com/4118-1/vendor-advisory, x-refsource-ubuntu
https://access.redhat.com/errata/RHSA-2019:2809vendor-advisory, x-refsource-redhat, third-party-advisory
http://packetstormsecurity.com/files/154957/Linux-Polkit-pkexec-Helper-PTRACE_TRACEME-Local-Root.htmlexploit, third-party-advisory, vdb-entry
http://packetstormsecurity.com/files/156929/Linux-PTRACE_TRACEME-Local-Root.htmlexploit, third-party-advisory, vdb-entry
http://packetstormsecurity.com/files/165051/Linux-Kernel-5.1.x-PTRACE_TRACEME-pkexec-Local-Privilege-Escalation.htmlexploit, third-party-advisory, vdb-entry
https://support.f5.com/csp/article/K91025336?utm_source=f5support&amp%3Butm_medium=RSSthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.