CISA added CVE-2022-0995, a high-severity out-of-bounds write in the Linux kernel's watch_queue event notification subsystem, to its Known Exploited Vulnerabilities catalog on August 26, 2026, with a federal remediation deadline of September 9, 2026.
What Is It
An out-of-bounds memory write flaw (CWE-787) in the Linux kernel's watch_queue event notification subsystem. The flaw allows an attacker to overwrite parts of kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.
NVD scores it 7.8 HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), local attack vector, low complexity, low privileges required, no user interaction, with high impact to confidentiality, integrity, and availability. The CVSS v2 score is 7.2. CISA's SSVC assessment marks exploitation as active, automatable as no, and technical impact as total.
Why It Matters
KEV inclusion indicates CISA has evidence of exploitation in the wild, which raises this above a purely theoretical concern. Known ransomware campaign use is listed as Unknown.
This is a local privilege escalation primitive: an attacker who already has a low-privileged foothold, a compromised service account, a shell from another bug, an untrusted local user, can potentially escalate to kernel-level control. Public exploit material exists, with two writeups indexed on Packet Storm. Because the flaw sits in the upstream kernel, it is likely to affect downstream products that embed an affected kernel version, though exposure varies with how each vendor configures and builds the kernel.
What's Vulnerable
Per NVD configuration data, affected Linux kernel ranges are:
- 5.8 up to (but not including) 5.10.106
- 5.11 up to (but not including) 5.15.29
- 5.16 up to (but not including) 5.16.5
- 5.17 release candidates rc1 through rc8
Also listed as affected: Fedora 35, and NetApp firmware products including the H300e and H300s lines.
Patch Status
Fixed upstream in kernel commit 93ce93587d36493f2f86921fa79921b3cba63fbb. Fixed versions are 5.10.106, 5.15.29, and 5.16.5 or later. NetApp published advisory NTAP-20220429-0001 for its affected products.
CISA's required action: apply mitigations per vendor instructions in compliance with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and adhering to BOD 26-04 patching guidelines. Due date: September 9, 2026.