CVE-2022-0995

CVE-2022-0995 is an out-of-bounds (OOB) memory write in the Linux kernel's watch_queue event notification subsystem (CWE-787) that can overwrite parts of kernel state. A local user can trigger it through the watch_queue interface, for example by supplying a crafted event filter definition, causing the kernel to write beyond allocated memory when event notifications are processed. Successful exploitation may allow the local user to gain privileged (kernel/root) access or crash the system, yielding high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, local attack vector). Affected systems include mainstream Linux kernels (Fedora is explicitly listed) and NetApp HCI appliance firmware products that ship the affected kernel. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-26, two public proof-of-concepts are available, and EPSS puts 30-day exploitation probability at 9.5% (95th percentile), though ransomware use is unconfirmed.

What to do: Apply updated kernels from your distribution or vendor (Fedora kernel updates; NetApp fixes are delivered via the HCI firmware updates in its security advisory) and prioritize internet-exposed, multi-user hosts per CISA BOD 26-04, including the required forensics triage checks. Because exploitation requires local access, restrict untrusted local code execution and shell access on unpatched systems, and hunt for signs of local privilege escalation on high-exposure hosts. After remediation, verify the patched kernel package is installed and that the running kernel has actually been booted into the fixed version.