Live › vulnerability › CVE-2022-0185
Go to dashboardThe Linux kernel has a heap-based buffer overflow in the legacy_parse_param function in its Filesystem Context code. An attacker who can mount a filesystem can overflow kernel memory and escalate to root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| linux kernel | vendor | >= 5.1, < 5.4.173 | 5.4.173 |
| linux kernel | vendor | >= 5.5, < 5.10.93 | 5.10.93 |
| linux kernel | vendor | >= 5.11, < 5.15.16 | 5.15.16 |
| linux kernel | vendor | >= 5.16, < 5.16.2 | 5.16.2 |
| netapp h410c firmware | vendor | – | – |
| netapp h300s firmware | vendor | – | – |
| netapp h500s firmware | vendor | – | – |
| netapp h700s firmware | vendor | – | – |
| netapp h300e firmware | vendor | – | – |
| netapp h500e firmware | vendor | – | – |
| netapp h700e firmware | vendor | – | – |
| netapp h410s firmware | vendor | – | – |
| Linux Kernel | vendor | – | – |
Unknown from the sources.
Apply the Linux kernel update from your distribution or vendor that fixes CVE-2022-0185; discontinue use of unpatched systems if no update is available.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.
This page as .md · .json · in your agent: get_signal("CVE-2022-0185")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.