Live › vulnerability › CVE-2022-0995
Go to dashboardThe Linux kernel has an out-of-bounds write that lets a local user, meaning someone already with a shell or code running on the machine, gain root privileges or crash the system. CISA lists it as actively exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| linux kernel | vendor | >= 5.8, < 5.10.106 | 5.10.106 |
| linux kernel | vendor | >= 5.11, < 5.15.29 | 5.15.29 |
| linux kernel | vendor | >= 5.16, < 5.16.5 | 5.16.5 |
| linux kernel | vendor | = 5.17 | – |
| fedoraproject fedora | vendor | = 35 | – |
| netapp h300e firmware | vendor | – | – |
| netapp h300s firmware | vendor | – | – |
| netapp h410c firmware | vendor | – | – |
| netapp h410s firmware | vendor | – | – |
| netapp h500e firmware | vendor | – | – |
| netapp h500s firmware | vendor | – | – |
| netapp h610c firmware | vendor | – | – |
| netapp h610s firmware | vendor | – | – |
| netapp h615c firmware | vendor | – | – |
| netapp h700e firmware | vendor | – | – |
| netapp h700s firmware | vendor | – | – |
| Linux Kernel | vendor | – | – |
uname -r to see the running kernel version, then compare it against the fixed kernel builds from your distribution's security advisory for CVE-2022-0995
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2022-0995")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.