CVE-2019-11479

What it actually does

The Linux kernel TCP implementation hardcodes a default MSS of 48 bytes, allowing a remote peer to induce excessive fragmentation of TCP retransmission queues far beyond normal levels and exhaust kernel resources.

Why it matters to the business

Network services and systems running affected kernels can be taken offline remotely, causing widespread service outages and forcing emergency kernel upgrades across large server fleets.

How an attack unfolds

An unauthenticated remote attacker sends TCP packets crafted to advertise a 48-byte MSS; when retransmissions occur the kernel fragments the resend queue into an abnormally large number of segments, rapidly consuming memory and CPU until the system becomes unresponsive.

How to fix it

Upgrade the Linux kernel to one of the fixed releases (4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11 or later commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 / 5f3e2bf008c2221478101ee72f5cb4654b9fc363) and apply the corresponding vendor patches for all affected distributions and appliances.

How to confirm the fix worked

Verify the running kernel version against the fixed releases listed above; confirm that TCP MSS handling no longer permits 48-byte fragmentation under retransmission scenarios via packet capture or vendor-specific diagnostics.

Typical attack path

1. Establish a TCP connection or send initial segments advertising a minimal MSS
2. Force or wait for retransmission conditions
3. Observe kernel resource exhaustion and service denial

How to detect it

Review system and kernel logs for repeated TCP retransmission storms or anomalous memory pressure in the networking stack; correlate with external traffic exhibiting unusually small advertised MSS values.

What your security team should do

• Prioritize kernel upgrades on all internet-facing and high-value systems within the next maintenance window
• Monitor vendor advisories for downstream packages and appliances that embed the vulnerable kernel
• Apply network-level MSS clamping where immediate patching is not feasible