A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculati…

published 2020-07-13 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-8959

cvss: 5.5; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits: 0; none known

A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.

Patch / fix

fixed in 1 distros 3 links 2

linux linux_kernel 5.5

red hat suse opensuse

kernel-rt RHEL 7 EXTRAS_RT 3.10.0-1062.18.1.rt56.1044.el7
kernel-rt-kvm RHEL 7 EXTRAS_RT 3.10.0-1062.18.1.rt56.1044.el7
kernel-rt-trace RHEL 7 EXTRAS_RT 3.10.0-1062.18.1.rt56.1044.el7
kernel-rt-debug-kvm RHEL 7 EXTRAS_RT 3.10.0-1062.18.1.rt56.1044.el7
kernel-rt-trace-kvm RHEL 7 EXTRAS_RT 3.10.0-1062.18.1.rt56.1044.el7
kernel-rt-debuginfo-common-x86_64 RHEL 7 EXTRAS_RT 3.10.0-1062.18.1.rt56.1044.el7
kernel RHEL 7 3.10.0-1062.18.1.el7
perf RHEL 7 3.10.0-1062.18.1.el7

red hat advisories RHSA-2020:0839 RHSA-2020:0834 RHSA-2020:1465 RHSA-2020:0328 RHSA-2020:0339

kernel-rt Real Time Module 15 SP1 4.12.14-14.17.1
kernel-syms-rt Real Time Module 15 SP1 4.12.14-14.17.1
kernel-rt_debug Real Time Module 15 SP1 4.12.14-14.17.1
kernel-source-rt Real Time Module 15 SP1 4.12.14-14.17.1
kernel-rt SLE Real Time 12 SP4 4.12.14-8.12.1
kernel-syms-rt SLE Real Time 12 SP4 4.12.14-8.12.1
kernel-rt_debug SLE Real Time 12 SP4 4.12.14-8.12.1
kernel-source-rt SLE Real Time 12 SP4 4.12.14-8.12.1

suse advisories SUSE-SU-2020:0613-1 SUSE-SU-2020:0599-1 SUSE-SU-2020:0584-1 SUSE-SU-2020:0560-1 SUSE-SU-2020:0511-1 SUSE-SU-2020:0093-1

kernel-source openSUSE Tumbleweed 5.14.6-1.4
kernel-source openSUSE Tumbleweed 6.6.17-1.1
kernel-syms openSUSE Leap 15.1 4.12.14-lp151.28.40.1
kernel-obs-qa openSUSE Leap 15.1 4.12.14-lp151.28.40.1
kernel-source openSUSE Leap 15.1 4.12.14-lp151.28.40.1
kernel-default openSUSE Leap 15.1 4.12.14-lp151.28.40.1
kernel-vanilla openSUSE Leap 15.1 4.12.14-lp151.28.40.1
kernel-kvmsmall openSUSE Leap 15.1 4.12.14-lp151.28.40.1

opensuse advisories openSUSE-SU-2024:10728-1 openSUSE-SU-2024:13704-1 openSUSE-SU-2020:0336-1

openwall.com/lists/oss-security/2019/12/10/3 advisory
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19338 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-19338 updated 2026-11-05 cvss 5.5

Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135)

Red Hat Enterprise Linux 5 kernel
affected: workaround, no fix planned “Out of support scope”
Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-147.5.1.el8_1, kernel-debuginfo-common-aarch64 4.18.0-147.5.1.el8_1, kernel-debuginfo-common-ppc64le 4.18.0-147.5.1.el8_1 Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-147.5.1.el8_1, kernel 4.18.0-147.5.1.el8_1, bpftool 4.18.0-147.5.1.el8_1, kernel-core 4.18.0-147.5.1.el8_1, kernel-tools 4.18.0-147.5.1.el8_1, python3-perf 4.18.0-147.5.1.el8_1, +15 more
fixed: vendor fix RHSA-2020:0339
Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-1062.18.1.el7, kernel 3.10.0-1062.18.1.el7, bpftool 3.10.0-1062.18.1.el7, python-perf 3.10.0-1062.18.1.el7, kernel-tools 3.10.0-1062.18.1.el7, kernel-tools-libs 3.10.0-1062.18.1.el7, +2 more Red Hat Enterprise Linux Client Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1062.18.1.el7 Red Hat Enterprise Linux ComputeNode (v. 7) perf 3.10.0-1062.18.1.el7, kernel 3.10.0-1062.18.1.el7, bpftool 3.10.0-1062.18.1.el7, python-perf 3.10.0-1062.18.1.el7, kernel-tools 3.10.0-1062.18.1.el7, kernel-tools-libs 3.10.0-1062.18.1.el7, +2 more
fixed: vendor fix RHSA-2020:0834
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) perf 3.10.0-957.48.1.el7, kernel 3.10.0-957.48.1.el7, bpftool 3.10.0-957.48.1.el7, python-perf 3.10.0-957.48.1.el7, kernel-tools 3.10.0-957.48.1.el7, kernel-tools-libs 3.10.0-957.48.1.el7, +2 more
fixed: vendor fix RHSA-2020:1465
Red Hat Enterprise Linux ComputeNode Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1062.18.1.el7
fixed: vendor fix RHSA-2020:0834
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) kernel-debuginfo-common-x86_64 3.10.0-957.48.1.el7
fixed: vendor fix RHSA-2020:1465
Red Hat Enterprise Linux for Real Time for NFV (v. 7) kernel-rt 3.10.0-1062.18.1.rt56.1044.el7, kernel-rt-kvm 3.10.0-1062.18.1.rt56.1044.el7, kernel-rt-trace 3.10.0-1062.18.1.rt56.1044.el7, kernel-rt-debug-kvm 3.10.0-1062.18.1.rt56.1044.el7, kernel-rt-trace-kvm 3.10.0-1062.18.1.rt56.1044.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1062.18.1.rt56.1044.el7
fixed: vendor fix RHSA-2020:0839
Red Hat Enterprise Linux Real Time (v. 8) kernel-rt 4.18.0-147.5.1.rt24.98.el8_1, kernel-rt-core 4.18.0-147.5.1.rt24.98.el8_1, kernel-rt-modules 4.18.0-147.5.1.rt24.98.el8_1, kernel-rt-debug-core 4.18.0-147.5.1.rt24.98.el8_1, kernel-rt-debug-modules 4.18.0-147.5.1.rt24.98.el8_1, kernel-rt-modules-extra 4.18.0-147.5.1.rt24.98.el8_1, +2 more Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt 4.18.0-147.5.1.rt24.98.el8_1, kernel-rt-kvm 4.18.0-147.5.1.rt24.98.el8_1, kernel-rt-core 4.18.0-147.5.1.rt24.98.el8_1, kernel-rt-modules 4.18.0-147.5.1.rt24.98.el8_1, kernel-rt-debug-kvm 4.18.0-147.5.1.rt24.98.el8_1, kernel-rt-debug-core 4.18.0-147.5.1.rt24.98.el8_1, +4 more
fixed: vendor fix RHSA-2020:0328

show 8 more

Red Hat Enterprise Linux Realtime (v. 7) kernel-rt 3.10.0-1062.18.1.rt56.1044.el7, kernel-rt-trace 3.10.0-1062.18.1.rt56.1044.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1062.18.1.rt56.1044.el7
fixed: vendor fix RHSA-2020:0839
Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-1062.18.1.el7, kernel 3.10.0-1062.18.1.el7, bpftool 3.10.0-1062.18.1.el7, python-perf 3.10.0-1062.18.1.el7, kernel-kdump 3.10.0-1062.18.1.el7, kernel-tools 3.10.0-1062.18.1.el7, +7 more
fixed: vendor fix RHSA-2020:0834
Red Hat Enterprise Linux Server EUS (v. 7.6) perf 3.10.0-957.48.1.el7, kernel 3.10.0-957.48.1.el7, bpftool 3.10.0-957.48.1.el7, python-perf 3.10.0-957.48.1.el7, kernel-kdump 3.10.0-957.48.1.el7, kernel-tools 3.10.0-957.48.1.el7, +7 more
fixed: vendor fix RHSA-2020:1465
Red Hat Enterprise Linux Server Optional (v. 7) kernel-debuginfo-common-ppc64 3.10.0-1062.18.1.el7, kernel-debuginfo-common-x86_64 3.10.0-1062.18.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-1062.18.1.el7
fixed: vendor fix RHSA-2020:0834
Red Hat Enterprise Linux Server Optional EUS (v. 7.6) kernel-debuginfo-common-ppc64 3.10.0-957.48.1.el7, kernel-debuginfo-common-x86_64 3.10.0-957.48.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-957.48.1.el7
fixed: vendor fix RHSA-2020:1465
Red Hat Enterprise Linux Workstation (v. 7) perf 3.10.0-1062.18.1.el7, kernel 3.10.0-1062.18.1.el7, bpftool 3.10.0-1062.18.1.el7, python-perf 3.10.0-1062.18.1.el7, kernel-tools 3.10.0-1062.18.1.el7, kernel-tools-libs 3.10.0-1062.18.1.el7, +2 more Red Hat Enterprise Linux Workstation Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1062.18.1.el7
fixed: vendor fix RHSA-2020:0834
Red Hat Virtualization 4.2 Hypervisor for RHEL 7.6 EUS perf 3.10.0-957.48.1.el7, python-perf 3.10.0-957.48.1.el7
fixed: vendor fix RHSA-2020:1465
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, kernel-alt, python-perf, kernel-kdump, kernel-tools, +3 more Red Hat Enterprise MRG 2 kernel-rt, mrg-rt-release, kernel-rt-trace, kernel-rt-vanilla, kernel-rt-firmware
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	5.5	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

[UNKNOWN] Linux Kernel

Classification

Weakness

CWE-385 Covert Timing Channel
CWE-203 Observable Discrepancy

Technology feeds

Linux kernel rss critical rss

References

openwall.com /lists/oss-security/2019/12/10/3
mailing-list, patch, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-19338
issue-tracking, patch, third-party-advisory
software.intel.com /security-software-guidance/insights/deep-dive-intel-transactional-synchronization-extensions-intel-tsx-asynch
third-party-advisory

Sources

CVE List CVE-2019-19338
NVD CVE-2019-19338

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary