CVE-2022-0995 is an out-of-bounds write vulnerability (CWE-787) in the Linux kernel’s watch_queue event notification subsystem, which allows user-space programs to receive notifications about kernel events. It carries a CVSS v3.1 Base Score of 7.8 (vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

When an application sets up a watch queue filter, the kernel does not properly validate that the supplied filter type falls within the bounds of the allocated bitmap. A local user can therefore specify an out-of-range value and cause the kernel to write beyond the intended buffer, corrupting kernel memory. This can be used to overwrite kernel data structures and escalate privileges from an unprivileged user to root, or to crash the system.

The flaw was discovered and disclosed on 14 March 2022. 

Linux kernels containing the watch_queue subsystem, which was introduced in kernel version 5.8, up to the version in which the fix was applied - (Affected)

Kernels carrying the upstream fix, or the vendor-backported fix supplied by the distribution - (Not affected, patched)

Because distributions backport security fixes rather than adopting new kernel versions, the upstream version number is not a reliable indicator of whether a system is patched. 

This is a local privilege escalation vulnerability. An attacker must already be able to run commands on the system before it can be used, so it is not an entry point in itself. Its significance is that it converts limited access into complete control of the host.

An attacker who has compromised a public-facing application, or who holds an ordinary user account, gains root privileges and with them the ability to read all data on the system, disable security tooling, install persistent access, and use stored credentials to reach further systems. Because the flaw is in the kernel rather than in an application, no application-level control prevents it.

CERTVU recommends the following:
1.     Update the Kernel
Apply the current kernel package supplied by your distribution vendor through the normal package manager. Check the running kernel version first, and confirm the fixed version against your vendor’s advisory rather than against the upstream version number.

uname -r

2.     Reboot After Updating
A kernel update does not take effect until the system is restarted. A server that has been patched but not rebooted is still running the vulnerable kernel and remains fully exploitable. CERTVU highlights this because it is the most common reason kernel vulnerabilities persist on otherwise well-maintained systems. Verify after rebooting that the running kernel is the updated one.

Other mitigating options include;
-    Prioritise Multi-User and Internet-Facing Hosts
-    Review for Prior Compromise

Report suspected compromise to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.