CVE-2022-0995 — Linux Kernel: Linux Kernel Out-of-Bounds Write Vulnerability

1. Executive summary

CVE-2022-0995 is a HIGH-severity out-of-bounds write vulnerability (CVSS 7.8) in the Linux Kernel. The flaw allows a local, authenticated user to escalate privileges or cause a denial of service. As of 2026-08-26, this CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, though the source material indicates that use by ransomware campaigns is currently unknown. EMEA financial services running affected Linux distributions should prioritise patching, particularly on multi-tenant or shared infrastructure where local user boundaries are critical security controls.

2. Regulatory framing

3. Technical analysis & attack chain

Vulnerability mechanism: CVE-2022-0995 is an out-of-bounds memory write vulnerability in the Linux Kernel, classified under CWE-787. The flaw exists in the kernel's memory management and can be triggered by a local user. An attacker with local access to an affected system can exploit this vulnerability to write data beyond the bounds of an allocated memory buffer. This can result in privilege escalation to root or a system denial-of-service condition.

Attack chain

1. Initial access: Attacker requires local, authenticated access to the target Linux system (low-privilege user account).
2. Vulnerability trigger: Attacker executes a crafted exploit targeting the out-of-bounds write flaw in the kernel, manipulating memory allocation to write controlled data to an unintended kernel memory location.
3. Privilege escalation: The out-of-bounds write is leveraged to overwrite kernel structures or function pointers, enabling the attacker to execute code in kernel context (ring 0), achieving root-level privileges.
4. Impact: With root access, the attacker can modify system files, install persistence mechanisms, access all data on the host, or disrupt system operations (denial of service).

Scope and severity: CVSS 7.8 (HIGH). The attack vector is local (AV:L), requiring no network access and no privileges beyond a standard local user account. User interaction is not required.

Confidence caveat: The NVD entry and CISA KEV listing corroborate the vulnerability classification and exploitation status. No specific threat actor attribution is provided in the source material. CISA KEV data indicates the vulnerability is being exploited, but details on specific campaigns, actors, or exploit payloads are not available in the provided sources. Ransomware campaign use is explicitly listed as "Unknown."

4. Mitigation & containment

P1 — Within 24 hours

• Identify all Linux-based assets in the estate, prioritising multi-tenant systems, shared hosting environments, and systems where untrusted local users have shell access.
• Check kernel versions against vendor advisories to determine exposure. Run uname -r on all Linux hosts to collect running kernel versions.
• Apply vendor-patched kernel updates immediately on systems confirmed to be affected. Reboot to activate the patched kernel.

P2 — Within 72 hours

• For systems where patching cannot be performed immediately, restrict local user access. Disable or lock non-essential local user accounts. Enforce SSH key-only authentication and review /etc/passwd and /etc/shadow for unauthorised or stale accounts.
• Deploy or verify EDR/Linux monitoring agents on affected hosts to detect anomalous kernel-level activity or privilege escalation attempts.
• If mitigations are unavailable, follow CISA BOD 26-04 guidance: evaluate the asset's exposure and discontinue use of the product if risk cannot be adequately reduced.

P3 — Within 7 days

• Complete patching across the entire Linux estate, including development, staging, and legacy environments.
• Validate patch deployment by confirming running kernel version post-reboot (uname -r).
• Review and update baseline Linux hardening standards to restrict local user shell access where not required.

5. Indicators of compromise

No indicators of compromise available in the source material.

6. Detection

Insufficient indicators to author detection rules.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• NVD, CVE-2022-0995 — Linux Kernel Out-of-Bounds Write Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2022-0995, published 2026-08-25
• CISA KEV Catalog, CVE-2022-0995 entry (added 2026-08-26), referenced via NVD source

8. Adverse Trace position

CVE-2022-0995 is a confirmed HIGH-severity Linux Kernel out-of-bounds write vulnerability with active exploitation evidenced by its inclusion in the CISA KEV catalog as of 2026-08-26. The local attack vector means the primary risk to EMEA financial services is on multi-tenant Linux infrastructure, shared hosting platforms, and any environment where untrusted users have local shell access. The CISA KEV remediation due date is 2026-09-09, giving clients a narrow window. Attribution to any specific threat actor is unconfirmed — no MITRE actor profile is available in the reference data, and ransomware involvement is explicitly unknown. We are treating this as a P1 patching priority for affected Linux estates and will monitor for emergence of public exploit code or IOCs that would enable detection rule development.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.