cve/2019/CVE-2019-15791.md

### [CVE-2019-15791](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15791)
![](https://img.shields.io/static/v1?label=Product&message=Shiftfs%20in%20the%20Linux%20kernel&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=5.3%20kernel%3E%3D%205.3.0-11.12%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-672%20Operation%20on%20a%20Resource%20after%20Expiration%20or%20Release&color=brighgreen)

### Description

In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referencing a file from the lower filesystem without taking an additional reference to that file. After the btrfs ioctl completes this fd is closed, which then puts a reference to that file, leading to a refcount underflow.

### POC

#### Reference
- https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=601a64857b3d7040ca15c39c929e6b9db3373ec1

#### Github
No PoCs found on GitHub currently.