Vulnerability record · CVE-2022-0995 · published 25 March 2022
CVE-2022-0995: Linux kernel watch_queue out-of-bounds write
Linux · Linux Kernel
The Linux kernel's watch_queue event notification subsystem contains an out-of-bounds write (CWE-787) that can overwrite kernel state. A local user can leverage this to escalate privileges or crash the system, making it a serious post-access escalation flaw on affected kernels.
Description
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityLocal privilege escalation with public exploit code and CISA KEV listing, though it requires local access and no ransomware use is documented.
What it is
The Linux kernel's watch_queue event notification subsystem contains an out-of-bounds write (CWE-787) that can overwrite kernel state. A local user can leverage this to escalate privileges or crash the system, making it a serious post-access escalation flaw on affected kernels.
Impact
An attacker with local access can corrupt kernel memory, potentially gaining privileged (root) access or causing a denial of service.
Attack surface
Reached locally via the watch_queue subsystem; the CVSS vector AV:L/PR:L/UI:N indicates a local attacker with low privileges and no user interaction required. No remote or network vector is described.
Exploitation
CISA added this to the KEV catalog (due 2026-09-09) and public exploit code is referenced on Packet Storm, indicating known exploitation; EPSS 30-day probability is about 9.5% (95th percentile). No ransomware campaign use is documented.
What to do
- Apply the upstream Linux kernel patch (commit 93ce93587d36493f2f86921fa79921b3cba63fbb) or the vendor kernel update for your distribution.
- For Fedora and NetApp products listed, apply the respective vendor advisories (Red Hat Bugzilla 2063786, NetApp ntap-20220429-0001).
- Restrict local shell and unprivileged account access on affected hosts to reduce the local attack surface.
- Follow CISA BOD 26-04 guidance and the KEV required action, discontinuing use of the product if no mitigation is available.
Detection
- Monitor for kernel crash or oops events tied to watch_queue and unexpected privilege escalation on affected hosts.
- Audit local user activity and process execution for known public exploit patterns against watch_queue.
- Track kernel versions against the patched commit to identify unpatched systems.
- Alert on anomalous root-level process creation from low-privileged local accounts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2022-0995 to the Known Exploited Vulnerabilities catalog on 26 August 2026 as "Linux Kernel Out-of-Bounds Write Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 9 September 2026.
Affected products
13 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-0995 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-0995), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
