Skip to content
Fencer Vulns
high 7.8

CVE-2022-0995 kev in the critical feed json

An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem.

published 2022-03-25 4 y ago modified 2026-08-27 2 mo ago also EUVD-2022-15988

cvss
7.8
version 3.1, CNA
cisa kev
Exploited
added 2026-08-26
epss
8.9%
EPSS 8.9% chance of exploitation in 30 days, percentile 95%
public exploits
1
Metasploit

Summary

An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.

Patch / fix

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

  • linux linux_kernel 5.10.106, 5.15.29, 5.16.5
  • linux Debian 14, Debian 13, Debian 12 5.16.18-1

debian advisories DEBIAN-CVE-2022-0995

  • linux Ubuntu 22.04 LTS 5.15.0-138.148
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1082.89
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1081.90
  • linux-gke Ubuntu 22.04 LTS 5.15.0-1079.85
  • linux-ibm Ubuntu 22.04 LTS 5.15.0-1074.77
  • linux-kvm Ubuntu 22.04 LTS 5.15.0-1078.83
  • linux-azure Ubuntu 22.04 LTS 5.15.0-1087.96
  • linux-gkeop Ubuntu 22.04 LTS 5.15.0-1064.72

ubuntu advisories UBUNTU-CVE-2022-0995

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-64kb SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS, SLE High Performance Computing 15 SP5-ESPOS 5.14.21-150500.55.100.1
  • kernel-syms SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.100.1
  • kernel-source SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.100.1
  • kernel-default SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 5.14.21-150500.55.100.1
  • kernel-obs-build SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.100.1
  • kernel-default-base SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.100.1.150500.6.47.1
  • kernel-rt SLE Micro 5.4, SLE Micro 5.3 5.14.21-150400.15.115.1
  • kernel-source-rt SLE Micro 5.4, SLE Micro 5.3 5.14.21-150400.15.115.1

suse advisories SUSE-SU-2025:1241-1SUSE-SU-2025:1183-1SUSE-SU-2025:1176-1SUSE-SU-2025:1027-1

  • kernel CBL-Mariner 2.0 5.15.32.1-3

azure linux advisories AZL-9152

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-0995 updated cvss 7.8

kernel: kernel bug in the watch_queue subsystem

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Virtualization 4 perf, python-perf
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/linux/local/cve_2022_0995_watch_queue)
  2. Published
  3. CISA SSVC: exploitation active
  4. Added to CISA KEV
  5. CISA patch deadline

Known exploited

Added
2 mo ago
Patch by
2026-08-29 (2 mo ago)
Ransomware
Not known
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Vendor, product
Linux, Kernel
CISA name
Linux Kernel Out-of-Bounds Write Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

8.86% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • n/a kernel

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.