CVE-2022-0185: Linux Kernel Filesystem Context Heap Buffer Overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe vulnerability is in the Linux kernel, allows local privilege escalation, has public exploits, and is listed in CISA KEV, indicating active exploitation.

What it is

The legacy_parse_param function in the Linux kernel's Filesystem Context functionality fails to properly verify supplied parameter lengths, causing a heap-based buffer overflow. This allows a local user to corrupt kernel memory and escalate privileges on affected systems.

Impact

An attacker can gain elevated privileges on the system, potentially achieving root access. This can lead to full system compromise, including data theft, persistence, and lateral movement.

Attack surface

The flaw is reachable locally by an unprivileged user if unprivileged user namespaces are enabled; otherwise, it requires namespaced CAP_SYS_ADMIN privilege. No user interaction is needed, and the attack vector is local (AV:L).

Exploitation

CVE-2022-0185 is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Public exploit code is available, and EPSS indicates a high probability of exploitation (97.8th percentile).

What to do

• Apply the kernel patch from the official Linux kernel repository or your distribution's updated kernel package immediately.
• If patching is not possible, disable unprivileged user namespaces (e.g., set kernel.unprivileged_userns_clone=0) to reduce the attack surface.
• Restrict local access to systems and enforce least privilege to limit the impact of a successful exploit.
• Monitor vendor advisories (e.g., NetApp) for updates to affected products and apply them as they become available.
• Consider using security modules (e.g., SELinux, AppArmor) to constrain the impact of privilege escalation attempts.

Detection

• Monitor for local privilege escalation attempts by auditing process creation events for unusual parent-child relationships (e.g., unprivileged process spawning a root shell).
• Use kernel auditing (e.g., auditd) to track calls to fsconfig or mount-related syscalls that may trigger the vulnerable legacy_parse_param path.
• Deploy endpoint detection and response (EDR) rules to detect known exploit patterns, such as heap spraying or memory corruption indicators.
• Check for indicators of compromise from public exploits, such as specific file creations or network connections following privilege escalation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.