Linux kernel local privilege escalation (CVE-2022-0995) [PoC]

Actively exploited in the wild - CVE-2022-0995 is a high-severity out-of-bounds memory write in the Linux kernel’s watch_queue subsystem (all mainline versions from 5.8 through 5.16, and various 5.4/5.10 LTS branches) that lets a local user escalate privileges to root or crash the system. Patches are available in kernel 5.16.14, 5.15.28, 5.10.104, and 5.4.184 - update immediately.

Overview

CVE-2022-0995 is an out-of-bounds write vulnerability in the watch_queue event notification subsystem of the Linux kernel. Watch_queue is a mechanism that allows processes to receive asynchronous notifications when specific events occur, such as keyring changes or pipe activity. The flaw arises from improper boundary checks when keystructures are copied into the watch queue buffer, allowing an attacker to overwrite adjacent memory in the kernel heap.

Because the vulnerability affects kernel memory, a successful exploit can overwrite critical kernel data structures. The result is either a denial of service (kernel panic) or, more seriously, local privilege escalation to root. The flaw requires only low privileges to trigger - a local user or process without special permissions can exploit it, and no user interaction is needed.

The vulnerability affects all Linux kernel versions from 5.8 onwards originally, with backports into LTS branches 5.10 and 5.4 as well. Distributions including Ubuntu, Debian, Red Hat, and SUSE have all shipped affected kernels in their standard repositories during the affected window.

Remediation and Mitigation

The Linux kernel community released fixes in March 2022. The following versions contain the upstream patch:

• Mainline: 5.16.14 and later
• Stable branches: 5.15.28+, 5.10.104+, 5.4.184+
• All long-term support kernels that backported the fix

Immediate actions:

1. Apply your distribution’s kernel security update as soon as it is available (most major distros shipped patches within days of disclosure).
2. For systems where a reboot is disruptive, prioritize internet-facing or multi-tenant hosts first - these face the highest risk from a local attacker.
3. If patching is impossible, restrict local access to trusted users only. The flaw requires local execution, so limiting shell access to unprivileged accounts reduces exposure.
4. Check your kernel version with uname -r and compare against the fixed versions above.

CISA has added CVE-2022-0995 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Given the EPSS score of 6.3% probability of exploitation within 30 days, treat this as a pressing patching priority.

For broader context on recent actively exploited Linux kernel flaws, see the CISA KEV addition for CVE-2026-31431, and for a survey of related kernel-level privilege escalation issues affecting container environments, review the CrackArmor AppArmor analysis. This week’s broader exploit landscape is covered in the weekly threat roundup.

Security Insight

CVE-2022-0995 belongs to a recurring pattern: complex kernel subsystems that gain new features (like watch_queue in 5.8) frequently ship with subtle memory-safety defects that only surface under attack. The gap between a kernel feature’s introduction and its first exploitable bug is often measured in months, not years, which is why maintaining current kernels matters even for stable LTS deployments - the CVE-2022-0995 fix required updates to four separate LTS branches simultaneously. Organizations running older kernels for compliance reasons should treat these backported fixes as mandatory, since the active exploitation of this bug demonstrates that attackers do not wait for scheduled maintenance windows.

Further Reading

• Weekly Threat Roundup: Apache & cPanel Zero-Days (Apr 27 - May 3)
• CISA Adds Actively Exploited Linux Root Bug CVE-2026-31
• Nine CrackArmor Flaws in Linux AppArmor Enable Root
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs