[HIGH PRIORITY] Linux Kernel watch_queue Out-of-Bounds Write LPE (CVE-2022-0995)

⚠ HIGH PRIORITY — CISA KEV (Aug 26, 2026). CVE-2022-0995 is an out-of-bounds write in the Linux kernel watch_queue subsystem. A local user escalates to root on unpatched kernels — public exploit code exists. Re-added to KEV due to continued active exploitation on outdated Linux servers.

Affected kernels

• Linux kernel before fix commit (mainline ~5.17, backports vary by distro)
• RHEL, Ubuntu, Debian, SUSE builds without CVE-2022-0995 backport
• Containers sharing vulnerable host kernel inherit the flaw

Verify patch level

uname -r
rpm -q kernel 2>/dev/null | tail -1
apt list --installed 2>/dev/null | grep linux-image | tail -3
grep watch_queue /proc/kallsyms 2>/dev/null | head -1

Patching Method

1. Apply latest kernel security update from your Linux vendor (RHEL, Ubuntu, Debian, SUSE).
2. On RHEL: dnf update kernel then reboot.
3. On Ubuntu/Debian: apt install linux-image-generic then reboot.
4. Reboot is mandatory — kernel patch is not live until restart.
5. Verify new kernel with uname -r after reboot.
6. Limit local shell access on shared/multi-tenant Linux hosts.
7. Audit for suspicious setuid binaries or cron jobs created by low-privilege users.

uname -r
needs-restarting -r 2>/dev/null || [ $(uname -r) = "$(rpm -q kernel --last | head -1 | awk '{print $1}' | sed 's/kernel-//')" ]

Until patched

• Restrict SSH/shell access to trusted admin accounts only
• Enable auditd for watch_queue-related syscalls if monitoring available
• Prioritize internet-facing Linux servers with user shell access

CVSS: 7.8 High. Local exploit — dangerous after any foothold.