CVE-2021-22600: Linux kernel af_packet double free allows local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a kernel double free enabling local privilege escalation and is in CISA KEV, though exploitation requires local access and the EPSS probability is moderate.

What it is

A double free bug in packet_set_ring() in net/packet/af_packet.c lets a local user trigger memory corruption through crafted syscalls. It matters because the flaw sits in the core kernel packet socket code and can lead to privilege escalation or denial of service on affected Linux systems.

Impact

An attacker with local access can corrupt kernel memory to escalate privileges to root or crash the system, causing denial of service.

Attack surface

Reached locally via crafted syscalls against the AF_PACKET socket interface; the CVSS vector shows local access, low privileges and no user interaction. No remote or network vector is described.

Exploitation

CVE-2021-22600 is listed in CISA KEV with a 2022-05-02 remediation due date, and EPSS shows a 30-day probability of about 6.1 percent (93rd percentile). Reference tags include a kernel patch and vendor advisories, but no public exploit code is cited in the record.

What to do

• Apply the kernel patch (commit ec6af094ea28f0f2dda1a6a33b14cd57e36a9755) or upgrade to a kernel version past the affected range.
• Apply the Debian DSA-5096 and Debian LTS advisories, and NetApp advisory NTAP-20230110-0002 for affected products.
• Restrict local shell and container access to trusted users, since exploitation requires local code execution.
• Where patching is delayed, consider blocking unprivileged AF_PACKET socket creation via kernel or container policy.
• Track KEV remediation deadlines and confirm all affected hosts, including NetApp firmware appliances, are updated.

Detection

• Monitor for unexpected kernel crashes or oops messages referencing packet_set_ring or af_packet.
• Alert on privilege escalation from low-privileged accounts to root on Linux hosts.
• Audit AF_PACKET socket creation by unprivileged processes and unusual syscall patterns.
• Check kernel versions against the patched commit across servers, containers and NetApp appliances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.