{"id":"CVE-2022-0995","kind":"vulnerability","aliases":["CVE-2022-0995"],"related":[],"title":"An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem","description":"Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"The Linux kernel has an out-of-bounds write that lets a local user, meaning someone already with a shell or code running on the machine, gain root privileges or crash the system. CISA lists it as actively exploited.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2026-08-26T00:00:00+00:00","products":[{"name":"linux kernel","fixed":["5.10.106"],"affected":">= 5.8, < 5.10.106","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.15.29"],"affected":">= 5.11, < 5.15.29","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.16.5"],"affected":">= 5.16, < 5.16.5","ecosystem":"vendor"},{"name":"linux kernel","fixed":[],"affected":"= 5.17","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 35","ecosystem":"vendor"},{"name":"netapp h300e firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h300s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h410c firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h410s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h500e firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h500s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h610c firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h610s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h615c firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h700e firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h700s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kubernetes","linux","self-hosted","shared-hosts"],"not_affected_if":["managed-hosting","no-local-users"],"how_to_check":"uname -r to see the running kernel version, then compare it against the fixed kernel builds from your distribution's security advisory for CVE-2022-0995","fix":"Install the patched kernel from your distribution or vendor (exact fixed versions: unknown from these sources) and reboot. CISA's required action is to apply vendor mitigations; if none are available, discontinue use of the affected product.","status":"open","published_at":"2022-03-25T19:15:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:50+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:31:50Z","model":"claude-haiku-5-5","output":{"fix":"Install the patched kernel from your distribution or vendor (exact fixed versions: unknown from these sources) and reboot. CISA's required action is to apply vendor mitigations; if none are available, discontinue use of the affected product.","summary":"The Linux kernel has an out-of-bounds write that lets a local user, meaning someone already with a shell or code running on the machine, gain root privileges or crash the system. CISA lists it as actively exploited.","category":"infrastructure","who_cares":["linux","self-hosted","kubernetes","shared-hosts"],"confidence":0.7,"analyst_note":"Pull the fixed kernel versions per distribution (Ubuntu, Debian, RHEL) from the vendor advisories; the KEV entry gives no version ranges.","how_to_check":"uname -r to see the running kernel version, then compare it against the fixed kernel builds from your distribution's security advisory for CVE-2022-0995\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting","no-local-users"],"severity_if_unknown":"high"},"cost_usd":0.000405,"input_tokens":2190,"output_tokens":371,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':170C,196C,227C '-0995':24A,27A '-2022':23A,26A '26':169C,195C,226C 'access':143C 'accord':159C 'action':155C 'activ':121B 'adher':223C 'allow':136C 'alreadi':100B 'appli':156C 'applic':193C 'asset':217C 'base':174C 'bod':168C,194C,225C 'bound':5A,91B,130C 'caus':145C 'cisa':117B,153C,166C,183C 'cloud':199C 'code':105B 'complianc':164C 'contain':125C 'could':135C 'crash':114B 'cve':22A,25A 'denial':147C 'discontinu':202C 'ensur':163C,222C 'evalu':215C 'event':19A 'exploit':73B,122B 'exposur':220C 'fedora':37A 'fedoraproject':36A 'firmware':40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A 'flaw':9A 'follow':192C 'forens':185C 'found':11A 'gain':110B,141C 'guidanc':181C,197C 'guidelin':229C 'h300e':39A 'h300s':42A 'h410c':45A 'h410s':48A 'h500e':51A 'h500s':54A 'h610c':57A 'h610s':60A 'h615c':63A 'h700e':66A 'h700s':69A 'host':79B,82B 'infrastructur':74B 'instruct':162C 'internet':219C 'kernel':15A,29A,31A,33A,35A,72A,85B,124C 'kubernet':75B 'let':94B 'linux':14A,28A,30A,32A,34A,71A,76B,84B,123C 'list':118B 'local':96B,138C 'machin':109B 'mean':98B 'memori':7A,131C 'mitig':157C,208C 'netapp':38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A 'note':180C,191C 'notif':20A 'oob':6A 'out-of-bound':2A,88B,127C 'patch':228C 'priorit':171C 'privileg':112B,142C 'product':206C 'queue':18A 'requir':154C,187C 'respons':213C 'risk':176C 'root':111B 'run':106B 'secur':172C 'see':177C,188C 'self':78B 'self-host':77B 'servic':149C,200C 'share':81B 'shared-host':80B 'shell':103B 'someon':99B 'stakehold':211C 'subsystem':21A 'system':116B,152C 'triag':186C 'unavail':210C 'updat':173C 'url':178C,189C 'use':203C 'user':97B,139C 'vendor':161C 'vulner':133C 'watch':17A 'write':8A,92B,132C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-03-25T19:15:10+00:00","kev":{"dateAdded":"2026-08-26","dueDate":"2026-08-29","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-0995","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-0995","severity":null,"published_at":"2026-08-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:13+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-0995","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0995","severity":null,"published_at":"2022-03-25T19:15:10+00:00","modified_at":"2026-08-27T04:16:39+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}