CVE-2022-0995
Linux Kernel Out-of-Bounds Write Vulnerability
Description
CVE-2022-0995 is a high-severity out-of-bounds write vulnerability in the Linux kernel's watch_queue event notification subsystem. The flaw allows attacker-controlled data to overwrite parts of kernel state, which a local user can leverage either to gain privileged access — in practice root — or to cause a denial of service by crashing the system. Because watch_queue is reachable from unprivileged contexts and the corruption lands directly in kernel memory, CVE-2022-0995 became a widely used local privilege escalation primitive against Linux systems. Kernel versions 5.8 up to 5.10.106, 5.11 up to 5.15.29, 5.16 up to 5.16.5 and 5.17 are affected, along with Fedora 35 and a broad set of NetApp appliance firmware. The Linux kernel vulnerability carries a CVSS score of 7.8, an EPSS score of roughly 9.5% at the 95th percentile, public exploit code, and a CISA Known Exploited Vulnerabilities (KEV) listing.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| linux | linux kernel | >= 5.8, < 5.10.106; >= 5.11, < 5.15.29; >= 5.16, < 5.16.5; 5.17 |
| fedoraproject | fedora | 35 |
| netapp | h300e firmware | - |
| netapp | h300s firmware | - |
| netapp | h410c firmware | - |
| netapp | h410s firmware | - |
| netapp | h500e firmware | - |
| netapp | h500s firmware | - |
| netapp | h610c firmware | - |
| netapp | h610s firmware | - |
| netapp | h615c firmware | - |
| netapp | h700e firmware | - |
| netapp | h700s firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/166770/Linux-watch_queue-Filter-Out-Of-Bounds-Write.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/166815/Watch-Queue-Out-Of-Bounds-Write.html(Exploit, Third Party Advisory, VDB Entry)
- https://bugzilla.redhat.com/show_bug.cgi?id=2063786(Issue Tracking, Patch, Third Party Advisory)
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb(Patch, Vendor Advisory)
- https://security.netapp.com/advisory/ntap-20220429-0001/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0995(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
An out-of-bounds write occurs when software writes data to a memory location outside the intended boundaries of a buffer, whether through a buffer overflow, incorrect array indexing, pointer arithmetic errors or an integer overflow affecting a size calculation. In CVE-2022-0995 the watch_queue notification filter code writes past the end of its allocation, and because that allocation lives in kernel memory, the spilled data overwrites adjacent kernel state that the system itself relies on.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2022-0995 requires local access and only low privileges, with low attack complexity and no user interaction — an ordinary unprivileged user account that can reach the watch_queue interface is enough. The result is high impact to confidentiality, integrity and availability, since overwriting kernel state gives an attacker the means to escalate to root, at which point every file, credential and process on the host is exposed, security tooling can be disabled and persistence installed; the same corruption can equally be used simply to panic the kernel. This is a textbook second-stage vulnerability: it converts any foothold — a compromised service account, a web shell, an untrusted user on a shared host — into full system control. On container platforms and multi-tenant infrastructure that also means a route out of the tenant boundary. The CVSS 3.1 base score is 7.8 (High), but the EPSS score of approximately 9.5% in the 95th percentile is unusually high for a local flaw and reflects that working exploits are public and in routine use.
Exploit Maturity
CVE-2022-0995 is fully weaponised and publicly documented. Public exploit code is available from multiple sources: Packet Storm Security hosts both Linux watch_queue Filter Out-Of-Bounds Write and Watch Queue Out-Of-Bounds Write, both tagged as exploit references, and the Red Hat Bugzilla report together with the public upstream fix commit allows precise patch diffing. CISA has confirmed active exploitation through its KEV listing. The EPSS score of roughly 9.5%, in the 95th percentile, is striking for a local privilege escalation — EPSS normally scores such flaws low because it models internet-facing scanning — and indicates that this exploit is a standard component of post-compromise toolkits. Any unpatched host running an affected kernel should be considered one foothold away from full compromise.
Remediation
- Follow the CISA KEV required action. Apply mitigations in accordance with your distribution's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the affected systems if mitigations are unavailable. The KEV due date of 9 September 2026 has passed.
- Update the kernel to a fixed release and reboot. Fixed versions are 5.10.106, 5.15.29 and 5.16.5 and later; affected ranges are 5.8 up to 5.10.106, 5.11 up to 5.15.29, 5.16 up to 5.16.5 and 5.17. The upstream fix commit documents the change, and kernel updates take effect only after a reboot.
- Patch affected appliances, not just servers. NetApp has published advisory NTAP-20220429-0001 covering H300E, H300S, H410C, H410S, H500E, H500S, H610C, H610S, H615C, H700E and H700S firmware; embedded and appliance Linux is routinely missed in kernel patch campaigns and should be inventoried explicitly.
- Restrict access to
watch_queuewhere patching must wait. The vulnerable subsystem is reachable from unprivileged user space, so restricting unprivileged user namespaces and applying seccomp profiles that deny the relevant syscalls reduces reachability for untrusted workloads and containers. Treat this as containment, not a fix. - Hunt for exploitation and harden long term. Alert on unexplained kernel oopses and panics, which commonly precede a successful memory-corruption exploit, and use audit or EDR telemetry to flag processes that acquire root from unprivileged parents; then establish a short kernel patch cadence with live patching or scheduled reboot windows, and prioritise shared hosts, CI runners and container nodes where untrusted code executes as a local user.
Technical Details
CVE-2022-0995 is an out-of-bounds write (CWE-787) in the Linux kernel's watch_queue event notification subsystem, the mechanism that delivers kernel notifications such as key and keyring events to user space through a pipe. The subsystem's filter handling contains a boundary error that permits a write beyond the intended limits of a kernel allocation, so attacker-influenced data overwrites adjacent kernel memory — the advisory describes this as overwriting "parts of the kernel state". Kernel heap corruption of this kind is a general-purpose exploitation primitive: by shaping which structures neighbour the overflowing allocation, an attacker can corrupt pointers or privilege fields and convert the write into arbitrary kernel read and write, and ultimately into root. If the corruption is not shaped precisely, the same defect simply crashes the kernel, which is the denial of service the advisory also notes. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H records a local, low-complexity, low-privilege attack with no user interaction and complete impact on confidentiality, integrity and availability at unchanged scope.
Frequently Asked Questions
Is CVE-2022-0995 being actively exploited?
Yes. CISA added CVE-2022-0995 to its Known Exploited Vulnerabilities catalog with a remediation due date of 9 September 2026, and multiple working exploits have been publicly available on Packet Storm Security since 2022. Its EPSS score of about 9.5% places it in the 95th percentile, unusually high for a local privilege escalation and a sign of routine use.
What products are affected by CVE-2022-0995?
The Linux kernel is affected in versions 5.8 up to 5.10.106, 5.11 up to 5.15.29, 5.16 up to 5.16.5, and 5.17, along with Fedora 35. NetApp has also confirmed a broad set of affected appliance firmware including H300E, H300S, H410C, H410S, H500E, H500S, H610C, H610S, H615C, H700E and H700S.
How do I fix CVE-2022-0995?
Update the kernel to 5.10.106, 5.15.29 or 5.16.5 or later through your distribution and reboot so the patched kernel is running. Apply NetApp's advisory NTAP-20220429-0001 to affected appliances, and until patching completes restrict unprivileged user namespaces and use seccomp to limit reachability of the watch_queue interface from untrusted workloads.
How severe is CVE-2022-0995?
CVE-2022-0995 is rated High with a CVSS 3.1 base score of 7.8. It requires local access and only low privileges, needs no user interaction, and overwrites kernel state with high confidentiality, integrity and availability impact — realistically meaning root compromise of the host; with public exploit code and an EPSS score in the 95th percentile, unpatched systems are at immediate risk.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.