CVE-2022-0995: Linux kernel watch_queue out-of-bounds write

Exploited in the wild High 7.8 EPSS 8.9% Linux kernel

The watch_queue event notification subsystem, added in Linux 5.8, has an out-of-bounds memory write in its filter handling. A local user can use it to overwrite kernel memory and gain root or crash the system; public exploits are referenced in the CVE record. It was fixed in Linux 5.17 and the 5.10.106, 5.15.29 and 5.16.15 stable releases, and RHEL kernels were never affected. CISA added it to KEV on 26 August 2026.

• CVE-2022-0995CVE identifier
• 7.8CVSS 3.1 base score (high)
• 2026-08-26added to CISA's exploited list (US federal deadline 2026-08-29)
• 8.9%EPSS: chance of exploitation in the next 30 days (higher than 95% of CVEs)
• 2022-03-25published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• Linux 5.8 through 5.10.105
• Linux 5.11 through 5.15.28
• Linux 5.16 through 5.16.14

Fixed in:

• Linux 5.10.106
• Linux 5.15.29
• Linux 5.16.15
• Linux 5.17

Am I affected?

uname -r
dpkg -l 'linux-image*' | grep ^ii   # Debian/Ubuntu
rpm -q kernel   # RHEL/Fedora/Amazon/SUSE (SUSE: rpm -q kernel-default)

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update
sudo apt upgrade
sudo reboot
# Debian 10 and older are not affected; Debian 12 and 13 ship fixed kernels.

sudo apt update
sudo apt upgrade
sudo reboot
# Ubuntu 24.04 and later are not affected.

# Red Hat: no shipped RHEL kernel was affected (RHEL 6-9 listed as not affected). Nothing to do.

sudo dnf upgrade --refresh kernel
sudo reboot

sudo zypper refresh
sudo zypper patch --category security
sudo reboot

# Amazon Linux 2023
sudo dnf upgrade --releasever=latest 'kernel*'
# Amazon Linux 2
sudo yum update kernel
sudo reboot

sudo pacman -Syu
sudo reboot

# as root
apk update
apk upgrade
reboot

not Linux

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

Sources

• CVE record CVE-2022-0995
• NVD CVE-2022-0995
• CISA KEV entry CVE-2022-0995
• Debian security tracker CVE-2022-0995
• Ubuntu CVE page CVE-2022-0995
• Red Hat CVE page CVE-2022-0995
• SUSE CVE page CVE-2022-0995
• Amazon Linux ALAS CVE page CVE-2022-0995
• Upstream fix (merge of watch_queue fixes)
• Linux 5.10.106 ChangeLog (watch_queue fixes)
• Linux 5.16.15 ChangeLog (watch_queue fixes)
• Red Hat Bugzilla 2063786
• Ubuntu Livepatch notice LSN-0111-1
• https://security.netapp.com/advisory/ntap-20220429-0001/
• CISA Known Exploited Vulnerabilities catalog

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.