CVE-2022-0995

This bug is in the Linux “kernel,” the core part of your operating system that everything else depends on. With this flaw, a person who already has limited access to the machine can make the kernel write past the end of memory it should use, which can let them gain higher control or crash the system—like damaging the control room’s wiring so the whole building either falls under the wrong operator or shuts down.

This matters if you run a Linux kernel on systems used by your business (including Debian, Ubuntu, Fedora, Astra Linux, Red OS, ALT Linux, Osnova Onyx). Because the attack is local, it mainly becomes a risk if an attacker can get unprivileged access to the machine (for example, a low-permission user account or another way to run code locally). Per CISA KEV guidance, focus first on assets where the issue is reachable and patch can be applied; only treat it as likely if it’s reachable from the local environment through unprivileged local access.

This is RED because it’s actively exploited in the real world and has been added to CISA’s Known Exploited Vulnerabilities list. The weakness allows a local, unprivileged attacker to corrupt kernel memory, which means successful exploitation can quickly lead to full takeover or deliberate crashes.

Confirm exposure

• For each Linux host, identify the running kernel version:
  • If you’re using a distro tool, use its “kernel version” display.
  • Otherwise, confirm the kernel release installed and running (your IT team typically knows the exact command/workflow).
• Determine whether the relevant functionality is used in your environment:
  • The bug is in the watch_queue event notification subsystem; practically, this means you should treat the host as exposed if it runs a vulnerable Linux kernel and you have any local unprivileged user risk.

Apply the fix (target versions)

• Linux kernel: upgrade to a version fixed in 5.10.106.
• Use your distribution’s normal update channel for kernel packages from trusted sources.
• After updating, reboot so the fixed kernel is the one actually running.

If you can’t patch immediately

• Apply vendor-provided mitigations for CVE-2022-0995.
• Reduce the chance of a local attacker existing:
  • remove unnecessary local accounts,
  • enforce least privilege,
  • restrict who can log into the systems,
  • isolate or harden any exposed services that could lead to unprivileged local code execution.
• Treat any unusual repeated crashes or suspicious privilege changes as potential exploitation attempts.

Time guidance from CISA KEV

• CISA remediation due date for KEV: 2026-09-09.
• CISA also indicates stakeholders should follow BOD 26-04 prioritization guidance and handle cloud services appropriately (and discontinue use if mitigations are unavailable).

Monitor after remediation

• Watch for:
  • kernel crashes/reboots,
  • unusual authentication events that indicate local users gaining capabilities,
  • repeated patterns consistent with exploitation attempts.
• Keep updated on any distribution-specific follow-up advisories tied to this CVE.

Overview and severity

• CVE-2022-0995 is a Linux kernel vulnerability (watch_queue event notification subsystem) categorized as an out-of-bounds memory write (CWE-787). Impact includes kernel memory corruption, enabling local privilege escalation and/or denial of service.

Exploitation status

• Confirmed real-world exploitation: yes. It is listed in the CISA KEV catalog, added 2026-08-26, with a CISA remediation due date of 2026-09-09.
• Exploit maturity: public proof-of-concept exists (with multiple public PoCs reported), and active exploitation evidence has been cited by CISA.

Attack mechanism (how it’s triggered)

• A local attacker with unprivileged (low) permissions triggers the flaw, causing the kernel to perform an out-of-bounds write that corrupts kernel memory. This corruption can be leveraged to take control of the system or crash it.

EPSS note

• EPSS is provided as a prediction in the findings, but due to confirmed KEV/active exploitation evidence, it should not be used to gauge urgency.

What KEV means here

• KEV status indicates that CISA has evidence and expects organizations to prioritize remediation for systems where the vulnerable code path is present and exposure is plausible.