An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem.
Affects the Linux kernel's watch_queue event notification subsystem; the fix is in kernel 5.17 rc8.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in kernel 5.17 rc8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's watch_queue event notification subsystem is affected by a memory write flaw that can overwrite parts of the kernel's state. A local user could exploit this to gain elevated privileges on the system or crash it, causing a denial of service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
Affected versions
- n/a kernel
kernel 5.17 rc8
References 5
bugzilla.redhat.com
git.kernel.org
packetstormsecurity.com
security.netapp.com
Questions about CVE-2022-0995
What does this mean?
An out-of-bounds write in the kernel's watch_queue event notification code can overwrite parts of the kernel's state. The advisory says this could let the user gain privileged access or panic the system.Source: bugzilla.redhat.com
Am I affected, and how do I check?
The checked facts do not list specific affected kernel versions or setups. The flaw is in the watch_queue subsystem of the Linux kernel, so check your kernel version with uname -r and compare it against the fixed release.Source: bugzilla.redhat.com
What should I do about it?
Move to kernel 5.17 rc8 or a newer kernel that includes the fix. The checked facts do not list a workaround.Source: bugzilla.redhat.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-08-26, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data