CISA Adds Old Linux Kernel Privilege-Escalation Flaw (CVE-2022-0995) to KEV Catalog Amid Active Exploitation

CISA has added CVE-2022-0995, an out-of-bounds write vulnerability in the Linux kernel, to its Known Exploited Vulnerabilities (KEV) catalog, indicating it is being actively exploited in the wild. The flaw resides in the kernel's watch_queue notification subsystem and allows a local user to corrupt memory, potentially leading to privilege escalation or a denial-of-service condition. The upstream fix is tracked in the referenced kernel commit.

Why It Matters

• This is a local privilege escalation primitive, not remote code execution — it typically requires an attacker to already have some form of code execution or local access on the target system.
• That profile makes it especially relevant as a post-exploitation / privilege-escalation step in intrusion chains: an initial-access foothold (phishing, exposed service, stolen credentials) followed by a kernel exploit to gain root.
• Because the vulnerable subsystem has existed in the kernel for some time, unpatched systems across cloud instances, containers with shared kernels, and general Linux server fleets may be exposed regardless of distribution.
• CISA KEV inclusion generally carries a remediation deadline for U.S. federal agencies and is widely used by other organizations as a prioritization signal.

What Defenders Should Do Now

• Patch first: confirm kernel versions against vendor advisories and apply the fix referenced in the upstream commit as a priority for internet-facing and multi-tenant systems.
• Hunt for anomalous privilege transitions: look for unexpected processes escalating to root, unusual child processes spawned from services that shouldn't require root, or kernel crash/panic logs correlating with exploitation attempts.
• Monitor kernel-level telemetry: auditd, eBPF-based sensors, or EDR kernel modules that can flag suspicious use of kernel notification/watch_queue interfaces or unexpected syscall patterns preceding privilege changes.
• Reduce local attack surface: limit unprivileged local access where possible, and treat containers sharing a host kernel as an amplified blast-radius concern until patched.

Developing Intel

Details on the specific exploitation activity behind this KEV addition are limited at this time — CISA's catalog entry confirms active exploitation but does not detail threat actors, targets, or campaign scope. This is net-new, developing information; we will update as more becomes known. See the upstream kernel fix commit for technical reference: git.kernel.org commit 93ce93587d36.