CVE-2022-0995

What it actually does

The flaw permits an out-of-bounds memory write within the Linux kernel watch_queue event notification subsystem, allowing overwrite of adjacent kernel memory structures and state.

Why it matters to the business

Local attackers can obtain root-level access or crash affected Linux systems, enabling full host compromise, data theft, or service disruption. Active exploitation in the wild combined with CISA KEV listing and a 2026-08-29 remediation deadline increases urgency for organizations running vulnerable kernels.

How an attack unfolds

An attacker with local access supplies crafted input to the watch_queue subsystem to trigger the out-of-bounds write, corrupting kernel memory to escalate privileges or cause denial of service. The vulnerability has seen active exploitation in the wild.

How to fix it

Update the Linux kernel to a version containing commit 93ce93587d36493f2f86921fa79921b3cba63fbb or later; apply vendor-supplied kernel packages as soon as available.

How to confirm the fix worked

Confirm the running kernel version includes the referenced commit or later; attempt controlled reproduction of the flaw in an isolated test environment to verify the issue is resolved.

Typical attack path

1. Obtain local shell access on a vulnerable Linux system
2. Invoke watch_queue APIs with specially constructed event notifications
3. Trigger the out-of-bounds write to corrupt kernel memory
4. Leverage overwritten state for privilege escalation or kernel panic

How to detect it

Review system and kernel logs for unexpected watch_queue events, privilege changes, or kernel oops/panic messages around the time of suspected activity; correlate with process execution trails indicating local escalation attempts.

What your security team should do

• Prioritize kernel upgrades on all exposed Linux systems due to KEV status and known active exploitation
• Harden local access controls and monitor for anomalous watch_queue usage
• Incorporate the fixed commit identifier into patch management and vulnerability scanning processes