Linux Kernel Out-of-bounds Write
A bug in the Linux kernel's watch_queue feature lets a program already running on a machine corrupt kernel memory. That can let a normal logged-in user grab full administrator control or crash the whole system.
- Severity
- HighCVSS 3.1 ยท 7.8
- Fix
- Update availableFix recorded on Aug 26, 2026
- Affected versions
- kernel 5.17 rc8
- Weakness
- CWE-787Out-of-bounds Write
- Exploit likelihood
- 9.5% in 30 daysEPSS, higher than 95% of known flaws
- Affects
- Kernel
- Exploited
- Yes, in the wildListed by CISA
- Added to CISA list
- Aug 26, 2026
- Federal fix deadline
- Sep 9, 2026
How it works
A local user sets up a watch_queue notification buffer with a size that the kernel does not check correctly, and the kernel then writes event data past the end of that buffer into other kernel memory.
What to do
Check your running kernel version with uname -r and compare it against 5.10.106, 5.15.29, and 5.16.5, the fixed builds for each branch. Almost every mainstream Linux distribution shipped an updated kernel package once this was patched. Update to a kernel or above the fixed version for your branch through your distribution's normal package manager, then reboot so the new kernel loads.
Update Linux through its normal update channel, then confirm the installed version matches the newest vendor release.
Technical details
CVE-2022-0995 is an out-of-bounds write (CWE-787) in the watch_queue event notification subsystem of the Linux kernel, reachable by a local, unprivileged user through crafted watch_queue setup calls. Because the corruption happens in kernel memory, a successful exploit can escalate a normal user to root or crash the kernel, and the flaw is listed in vulnerability databases as exploited in the wild (VulnCheck KEV). It affects kernel 5.8 or later, 5.11 or later, and 5.16 or later; fixes landed in 5.10.106, 5.15.29, and 5.16.5, and distributions backported the patch into their own kernel package versions.
Severity breakdown
- Attack vector Local Needs local access to the machine
- Attack complexity Low Low complexity under the assessed conditions
- Privileges required Low Attacker needs a basic user account
- User interaction None No victim action needed
- Scope Unchanged Impact stays within the same security authority
- Confidentiality impact High Sensitive data can be exposed with serious impact
- Integrity impact High Protected data can be changed with serious impact
- Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator