CVE-2019-13272: Linux kernel ptrace credential mishandling allows local root escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a locally exploitable kernel privilege escalation to root with KEV-listed exploitation and very high EPSS, though it requires local access rather than being remotely reachable.

What it is

The Linux kernel before 5.1.17 mishandles credential recording in ptrace_link (kernel/ptrace.c) when a process creates a ptrace relationship, and also incorrectly marks the relationship as privileged. A local user can exploit parent-child process scenarios, such as a parent dropping privileges and calling execve, to gain root.

Impact

An attacker with local access gains full root privileges, including confidentiality, integrity and availability impact across the system. The flaw can also trigger a kernel panic through the object lifetime issue.

Attack surface

Reached locally by an authenticated user running code on the host; no user interaction or network access is required per the CVSS vector AV:L/PR:L/UI:N. The described path involves a parent-child process relationship and helpers such as Polkit's pkexec with PTRACE_TRACEME.

Exploitation

CISA KEV lists it as exploited with a 2021-12-10 addition and 2022-06-10 remediation due date, and multiple references are tagged Exploit. EPSS is 0.52199 (98.9th percentile), indicating high predicted exploitation activity.

What to do

• Patch the Linux kernel to 5.1.17 or later, or apply the vendor kernel update for your distribution (Red Hat, Debian, Ubuntu, Fedora, SUSE, NetApp advisories are referenced).
• Where patching is not immediately possible, enable SELinux deny_ptrace as a workaround in environments that support it.
• Restrict local interactive and service accounts to the minimum needed, since exploitation requires local code execution.
• Monitor and limit use of pkexec and other setuid helpers that can be combined with PTRACE_TRACEME.
• Track KEV remediation due dates and verify kernel versions across servers, appliances and firmware-listed products.

Detection

• Audit kernel versions on Linux hosts and appliances against the 5.1.17 fix threshold and vendor errata.
• Monitor for unexpected ptrace or PTRACE_TRACEME activity involving setuid helpers such as pkexec.
• Alert on privilege transitions to root from non-root parent processes that drop privileges and execve.
• Watch for kernel panic or oops events tied to ptrace credential handling.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.