CVE-2019-11487

What it actually does

Reference count overflow on struct page leading to use-after-free in kernel memory paths (fs/fuse/dev.c, fs/pipe.c, splice.c, mm/gup.c, hugetlb.c, trace.c) when handling FUSE requests on systems with approximately 140 GiB RAM.

Why it matters to the business

Local attackers can achieve privilege escalation or kernel-level code execution on high-memory Linux servers; the issue affects a narrow set of systems but has publicly available exploits and remains relevant for unpatched long-lived kernels.

How an attack unfolds

An attacker with local access issues specially crafted FUSE requests that drive repeated page reference operations, overflowing the refcount field on systems with sufficient RAM; the resulting use-after-free is leveraged for arbitrary kernel read/write and privilege escalation.

How to fix it

Upgrade the Linux kernel to a version containing commit 15fab63e1e57be9fdb5eec1bbc5916e9825e9acb (equivalent to 5.1-rc5 or later) and rebuild any custom modules or distributions accordingly.

How to confirm the fix worked

Verify the running kernel version is 5.1-rc5 or newer; confirm the patch commit appears in the kernel source tree and that FUSE-related page-refcount paths no longer contain the vulnerable overflow logic.

Typical attack path

1. Obtain a local shell or user context on the target host
2. Mount or interact with a FUSE filesystem to generate kernel page operations
3. Trigger repeated reference-count increments to cause overflow
4. Reuse the freed page object to corrupt kernel structures
5. Escalate to root or execute arbitrary kernel code

How to detect it

Monitor kernel logs for page-refcount or use-after-free warnings involving fuse, pipe, or gup; inspect FUSE filesystem activity from non-privileged users and correlate with any subsequent privilege-escalation events.

What your security team should do

• Prioritize kernel upgrades on any system with 128 GiB or more RAM that still runs a pre-5.1 kernel
• Disable or restrict FUSE access for untrusted local users until patches are applied
• Review and apply the fixed commit across all maintained kernel branches and downstream distributions