CVE-2019-14814

CVE-2019-14814 is a high-severity vulnerability in Redhat Enterprise Linux with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-122.

Key facts

• Severity: High (CVSS 3.x base score 7.8)
• CVSS v2: 7.2
• EPSS exploit prediction: 1% (54th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-122
• Affected product: Redhat Enterprise Linux
• Published: 2019-09-20
• Last modified: 2026-06-17

Description

There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.

Frequently asked questions

What is CVE-2019-14814?

There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.

How severe is CVE-2019-14814?

CVE-2019-14814 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2019-14814 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (54th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-14814?

CVE-2019-14814 primarily affects Redhat Enterprise Linux. In total, 47 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2019-14814?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2019-14814 published?

CVE-2019-14814 was published on 2019-09-20 and last updated on 2026-06-17.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html
• http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html
• http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
• http://www.openwall.com/lists/oss-security/2019/08/28/1
• https://access.redhat.com/errata/RHSA-2020:0174
• https://access.redhat.com/errata/RHSA-2020:0328
• https://access.redhat.com/errata/RHSA-2020:0339
• https://access.redhat.com/security/cve/cve-2019-14814
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14814
• https://github.com/torvalds/linux/commit/7caac62ed598a196d6ddf8d9c121e12e082cac3a
• https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html
• https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3RUDQJXRJQVGHCGR4YZWTQ3ECBI7TXH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4JZ6AEUKFWBHQAROGMQARJ274PQP2QP/
• https://seclists.org/bugtraq/2019/Nov/11
• https://security.netapp.com/advisory/ntap-20191031-0005/
• https://usn.ubuntu.com/4157-1/
• https://usn.ubuntu.com/4157-2/
• https://usn.ubuntu.com/4162-1/
• https://usn.ubuntu.com/4162-2/
• https://usn.ubuntu.com/4163-1/
• https://usn.ubuntu.com/4163-2/
• https://www.openwall.com/lists/oss-security/2019/08/28/1

Affected products (47)

• cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_for_real_time:8:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:8:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.2:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.4:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.2:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.4:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:messaging_realtime_grid:2.0:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
• cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
• cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
• cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:*
• cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
• cpe:2.3:a:netapp:service_processor:-:*:*:*:*:*:*:*
• cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
• cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
• cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:netapp:a320_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:netapp:c190_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:netapp:a220_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:netapp:fas2720_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:netapp:fas2750_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:netapp:a800_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

More vulnerabilities in Redhat Enterprise Linux

• CVE-2015-0240 — Critical (CVSS 10.0): The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before…
• CVE-2015-0408 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect…
• CVE-2014-6601 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality,…
• CVE-2009-0846 — Critical (CVSS 10.0): The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT…
• CVE-2007-1007 — Critical (CVSS 10.0): Format string vulnerability in GnomeMeeting 1.0.2 and earlier allows remote attackers to cause a denial of service…
• CVE-2006-6235 — Critical (CVSS 10.0): A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows…

All CVEs affecting Redhat Enterprise Linux →

Other CWE-122 (Heap-based Buffer Overflow) vulnerabilities

• CVE-2026-46752 — Critical (CVSS 10.0): Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from…
• CVE-2026-24822 — Critical (CVSS 10.0): Out-of-bounds Write, Heap-based Buffer Overflow vulnerability in ttttupup wxhelper (src modules). This vulnerability is…
• CVE-2025-23123 — Critical (CVSS 10.0): A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a…
• CVE-2022-34819 — Critical (CVSS 10.0): A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions <…
• CVE-2026-44050 — Critical (CVSS 9.9): A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote…
• CVE-2026-49841 — Critical (CVSS 9.8): FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to…

Browse all CWE-122 (Heap-based Buffer Overflow) vulnerabilities →