CVE-2019-11479: Linux kernel hard-coded 48-byte MSS enables remote TCP denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote, unauthenticated, low-complexity availability impact with a very high EPSS score, though not in KEV and requiring no user interaction.

What it is

The Linux kernel hard-codes a default TCP maximum segment size (MSS) of 48 bytes, letting a remote peer force excessive fragmentation of TCP resend queues. This is the SACK Panic family issue and allows a remote attacker to exhaust kernel memory and cause a denial of service. It affects the Linux kernel and multiple downstream products including F5 BIG-IP, Ubuntu, Red Hat Enterprise Linux and others.

Impact

An unauthenticated remote attacker can drive excessive memory allocation in the kernel's TCP resend queues, degrading or halting network service on the target host. No confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reachable over the network via TCP traffic to a listening service; the CVSS vector shows AV:N/AC:L/PR:N/UI:N, so no authentication or user interaction is required. Any host running an unpatched affected kernel or downstream product that accepts TCP connections is exposed.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high (0.9166 probability, 99.8th percentile), indicating strong likelihood of attempted exploitation. References are advisories and patches rather than public exploit code.

What to do

• Patch to a fixed kernel release (4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11) or later, or apply the referenced upstream commits.
• Apply vendor advisories for F5 BIG-IP, Ubuntu, Red Hat and other listed products, since they ship their own patched builds.
• Where patching is delayed, apply the documented workarounds such as lowering the advertised MSS or disabling SACK as described in vendor mitigation guidance.
• Restrict or rate-limit untrusted TCP traffic to exposed services and monitor for abnormal connection patterns.
• Track kernel and network appliance versions in inventory so unpatched systems are identified quickly.

Detection

• Monitor for spikes in TCP retransmissions, resend queue growth and kernel memory pressure on exposed hosts.
• Alert on large volumes of small-MSS TCP connections or unusual SACK behavior from single sources.
• Watch system logs and monitoring for OOM or network stack stalls correlated with inbound TCP traffic.
• Use network flow data to flag hosts receiving many fragmented or low-MSS TCP sessions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.