CVE-2022-0995: Linux Kernel Watch Queue Out-of-Bounds Write LPE

Executive summary

CVE-2022-0995 is an out-of-bounds (OOB) heap write vulnerability in the Linux kernel’s watch_queue event notification subsystem. A local, unprivileged user can trigger the flaw through a malformed filter specification passed via the IOC_WATCH_QUEUE_SET_FILTER ioctl, corrupting adjacent kernel heap memory. The result is privilege escalation to root or a kernel crash (denial of service). No user interaction is required and attack complexity is low.

The bug was found by Google Project Zero researcher Jann Horn and disclosed in March 2022. It carries a CVSS 3.1 base score of 7.8 (High), vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and is tracked under CWE-787 (Out-of-bounds Write).

CISA added CVE-2022-0995 to the Known Exploited Vulnerabilities (KEV) catalog on August 26, 2026, with a remediation due date of September 9, 2026. KEV additions signal that CISA has evidence of active in-the-wild exploitation, but the public advisory does not name a specific campaign, malware family, or threat actor behind this particular addition. Federal agencies and, by extension, any organization following CISA guidance should treat this as confirmed active exploitation and prioritize patching accordingly, even though the underlying bug is more than four years old.

Affected versions

The watch_queue subsystem was introduced in Linux kernel 5.8. The vulnerable bounds-checking logic in watch_queue_set_filter() persisted from that point through kernel 5.17-rc7, meaning every mainline kernel in the 5.8 through early 5.17-rc range is affected before the fix landed. This includes long-lived distribution kernels built on the 5.15 LTS line, which is why the bug remains relevant on current enterprise systems that carry backported 5.15-based kernels (for example, Ubuntu 22.04 LTS).

Distribution-specific affected ranges reported by vendors include:

• Ubuntu: kernels in the 5.15.x series shipped with 22.04 LTS, and backports to 20.04 LTS across generic, AWS, Azure, GCP, and GKE kernel variants.
• SUSE: SLE 15 SP4/SP5/SP6 and SUSE Linux Enterprise Micro 5.3–5.5 kernel-default builds prior to the fixed versions.
• Red Hat: Red Hat states no shipped RHEL kernel version was found affected by this specific code path, though downstream rebuilds and Fedora kernels tracked the issue (Fedora 35 was flagged).
• Debian: kernels built from the affected upstream range prior to the backported fix.

If you run a kernel built from the 5.8–5.16 series, or an early 5.17 release candidate, without the fix, you are exposed.

Vulnerability details

watch_queue provides an in-kernel event notification mechanism that delivers events (such as key/keyring changes or mount notifications) to userspace through a pipe-backed ring buffer. Userspace can attach filters to a watch queue via keyctl()/pipe2() setup followed by an IOC_WATCH_QUEUE_SET_FILTER ioctl, restricting which event types it receives.

The root cause is an inconsistency between validation and use. When watch_queue_set_filter() validates a caller-supplied watch_notification_filter structure, it checks that each filter’s event type field is less than 128. However, when the filter data is later copied into the kernel’s internal filter bitmap, the code permits values up to 1024 to be processed. Because the underlying bitmap allocation is sized for the smaller, correctly-validated range, an attacker can supply a type value in the 128–1024 window that passes the loose downstream check and is used to compute an offset into the bitmap, writing past the end of the allocated buffer.

Two primitives fall out of this discrepancy:

1. Controlled zeroing: the OOB path can zero bytes beyond the allocated filter structure, corrupting adjacent heap metadata or objects.
2. Arbitrary single-bit set: the __set_bit() operation used during filter copy can flip a single bit at an attacker-chosen offset within the 128–1024 range, in memory adjacent to the intended allocation.

On its own this is a heap corruption primitive rather than a directly weaponized privilege escalation. Public research (notably Quarkslab’s “PageJack in Action” writeup, published March 2026) demonstrates how the bit-flip primitive can be chained with pipe_buffer structures: by corrupting a bit in a pipe_buffer’s page-pointer-adjacent metadata, an attacker can cause two independent pipes to reference the same physical page. Closing one pipe frees that page while the second pipe retains a dangling reference, producing a use-after-free that is then leveraged for arbitrary read/write and, ultimately, root privilege escalation. This PageJack technique was originally presented at Black Hat USA 2024 as a general kernel exploitation pattern and was later shown to apply cleanly to this 2022 bug, illustrating how old, seemingly minor OOB primitives stay dangerous as exploitation tooling matures.

Earlier public exploits (predating PageJack) reused techniques originally developed for CVE-2021-22555 (a related netfilter heap OOB write) to turn the watch_queue primitive into privilege escalation, underscoring that multiple independent exploitation paths exist for this bug.

Exploitation in the wild

Multiple functional proof-of-concept exploits have been public for years. A Metasploit local exploit module (exploit/linux/local/cve_2022_0995_watch_queue) implements the technique, and standalone PoC source (for example, the Bonfee/CVE-2022-0995 repository) has circulated since shortly after disclosure, demonstrating privilege escalation on Ubuntu kernels of the era. Analysts have also noted an EPSS score in the mid-teens percentile range with a high percentile ranking, reflecting sustained interest from exploit developers well before the KEV listing.

CISA’s KEV addition on August 26, 2026 confirms evidence of active exploitation, which is what triggers KEV inclusion under CISA’s criteria. As of this writing, no public advisory, malware family report, or named campaign has been published that specifically documents how CVE-2022-0995 is being used in current attacks. The KEV entry itself does not include attribution or victim details, and known ransomware use is listed as unknown. Treat the KEV listing as authoritative evidence of exploitation, but do not assume a specific attacker or malware family without a corroborating source; we will update this article if CISA, a distro vendor, or a security research team publishes further detail. The PageJack research from March 2026 is independently notable because it shows a practical, reliable path from this bug to root, and may plausibly explain renewed attacker interest in an otherwise old CVE, but it is a research disclosure, not itself evidence of in-the-wild use.

Patch and remediation

The fix was merged upstream in commit 93ce93587d36493f2f86921fa79921b3cba63fbb, correcting the boundary handling in the filter setup path so the copy logic honors the same 128-entry limit enforced during validation. The fix landed for the 5.17 kernel and was backported to affected stable and LTS branches.

Remediation steps:

• Update to a kernel containing the fix. For distribution kernels, install the vendor-patched package rather than tracking upstream commits directly:
  • Ubuntu 22.04 LTS: linux ≥ 5.15.0-138.148 (and corresponding linux-aws, linux-azure, linux-gcp, linux-gkeop builds); Ubuntu 20.04 LTS carries equivalent backports across its kernel flavors.
  • SUSE SLE 15 SP4: kernel-default ≥ 5.14.21-150400.22.1; SP5 ≥ 5.14.21-150500.53.2; SP6 ≥ 6.4.0-150600.21.3; SUSE Linux Enterprise Micro 5.3/5.4 ≥ 5.14.21-150400.24.158.1, Micro 5.5 ≥ 5.14.21-150500.55.100.1.
  • Debian/Fedora: apply the current kernel security update from your distribution’s repositories.
• Reboot after patching. Kernel updates require a reboot to take effect; live-patching frameworks (kpatch, kgraft, Ubuntu Livepatch) that cover this CVE can bridge the gap on systems with strict maintenance windows.
• Restrict local access where patching is delayed. Because exploitation requires local code execution, tightly controlling who can execute arbitrary code on affected hosts (shell access, container escape surfaces, multi-tenant compute) reduces exposure until the patch is applied.
• Consider unprivileged_userns_clone and namespace restrictions as defense-in-depth; while not a direct mitigation for this specific bug, reducing the attack surface available to unprivileged local users generally raises the bar for kernel exploitation chains that combine multiple primitives.

Detection

Direct detection of this specific bug is difficult because the syscalls involved (keyctl(), pipe2(), and the IOC_WATCH_QUEUE_SET_FILTER ioctl) are legitimate kernel interfaces with benign uses. Focus detection on anomalous usage patterns and crash signatures rather than the syscalls alone:

• Kernel crash/panic logs: watch for OOPS or panic messages referencing watch_queue, watch_queue_set_filter, slab/heap corruption (kmalloc-* slab errors), or unexpected pipe-related crashes in dmesg / journalctl -k. Repeated crashes on the same host, especially around privilege boundaries, warrant investigation, since PoC and early-generation exploits are noted as unreliable and can crash the target during failed attempts.
• Syscall auditing: use auditd or eBPF-based tooling to log unusual or repeated invocations of the watch queue ioctl (IOC_WATCH_QUEUE_SET_FILTER) combined with pipe2() calls from unprivileged users, particularly in short bursts (consistent with exploit retry loops for an unreliable exploit).
• Unexpected privilege transitions: monitor for processes that unexpectedly acquire root (UID 0) capabilities without going through expected privilege-elevation paths (sudo, su, setuid binaries). EDR/host-based tooling that tracks process credential changes is well suited to catching the end result of a successful exploit even if the initial trigger is missed.
• Runtime kernel integrity: on systems with the capability, integrity monitoring or LKRG-style runtime kernel protection can flag unexpected kernel structure modifications consistent with heap corruption exploitation chains like PageJack’s pipe-buffer page aliasing.
• Container/multi-tenant boundaries: if affected kernels underlie container hosts, watch for container escapes correlated with kernel crash or corruption indicators, since local kernel LPEs are a common vector for breaking out of containers into the host.

Given the KEV due date of September 9, 2026, prioritize confirming your kernel version against the fixed builds listed above immediately, and treat any of the crash or privilege-escalation indicators above as high-priority triage items until patching is complete.

References

• NVD - CVE-2022-0995 Detail
• Red Hat Customer Portal - CVE-2022-0995
• Ubuntu Security - CVE-2022-0995
• SUSE Security - CVE-2022-0995
• Quarkslab - PageJack in Action: CVE-2022-0995 exploit
• Linux kernel fix commit 93ce93587d36
• Rapid7 - Metasploit module cve_2022_0995_watch_queue
• Bonfee/CVE-2022-0995 PoC exploit