CVE-2019-3016
Quick assessment
Affected
linux linux_kernel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux KVM是基于内核的虚拟机。 Linux KVM存在竞争条件问题漏洞。该漏洞源于网络系统或产品在运行过程中，并发代码需要互斥地访问共享资源时，对于并发访问的处理不当。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-3016
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: CVE Program / CVE List V5
Vulnerability Title
Linux KVM 竞争条件问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux KVM是基于内核的虚拟机。 Linux KVM存在竞争条件问题漏洞。该漏洞源于网络系统或产品在运行过程中，并发代码需要互斥地访问共享资源时，对于并发访问的处理不当。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| linux | linux_kernel | 4.10 to 5.6 | - |
|
II. Public POCs for CVE-2019-3016
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-3016
请登录查看更多情报信息。
Vendor Advisories for CVE-2019-3016 (5)
-
https://bugzilla.redhat.com/show_bug.cgi?id=1792167 x_refsource_CONFIRM
-
https://security.netapp.com/advisory/ntap-20200313-0003/ x_refsource_CONFIRM
-
-
-
Mailing List Discussions for CVE-2019-3016 (1)
Other References for CVE-2019-3016 (6)
-
https://git.kernel.org/linus/b043138246a41064527cf019a3d51d9f015e9796 x_refsource_CONFIRM
-
https://git.kernel.org/linus/917248144db5d7320655dbb41d3af0b8a0f3d589 x_refsource_CONFIRM
-
https://git.kernel.org/linus/a6bd811f1209fe1c64c9f6fd578101d6436c6b6e x_refsource_CONFIRM
-
https://git.kernel.org/linus/1eff70a9abd46f175defafd29bc17ad456f398a7 x_refsource_CONFIRM
-
https://git.kernel.org/linus/8c6de56a42e0c657955e12b882a81ef07d1d073e x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: linux_kernel
Same vendor: linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same weakness: CWE-362
-
CVE-2026-19571
Race condition in ITE IT8xxx2 SHI host-command backend lets -
CVE-2026-84230
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-84271
IBM Guardium Data Protection Signature Verification Bypass -
CVE-2026-42698
WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnera -
CVE-2026-94584
Brocade Fabric OS <10.0.1 竞态条件漏洞
V. Comments for CVE-2019-3016
No comments yet