{"id":"linux-watch-queue-exploited-aug-2026","category":"patch","status":"live","title":"Linux kernel CVE-2022-0995 used in attacks; fixes available, but some Ubuntu kernels remain vulnerable","tldr":"CISA confirms attacks using Linux kernel flaw CVE-2022-0995. Someone already able to run code locally could gain higher privileges or crash the machine. Install your Linux vendor's kernel update and restart; some older Ubuntu kernels remain vulnerable.","summary":"CVE-2022-0995 is a memory corruption flaw in watch_queue, the Linux kernel component that handles event notifications. Someone who can already run code locally could use it to gain higher privileges or crash the machine. Red Hat recorded the issue in March 2022 and identifies Linux 5.17-rc8 as fixed; it says none of its shipped kernels were found affected. Canonical released fixes for Ubuntu's 5.15-based kernels in April 2025. CISA confirmed exploitation on 26 August 2026, without publishing campaign or victim details. As of 3 November, patch coverage remains partial: Canonical's October tracker still marks several older Ubuntu kernel packages as vulnerable, although fixes exist for Ubuntu 22.04 and Ubuntu 20.04's 5.15 hardware-enablement kernel. The sources reviewed do not establish when attacks began or whether they have stopped.","action":"If you use Linux, install your distribution's kernel security updates and restart. For Ubuntu 22.04's standard 5.15 kernel, use package version 5.15.0-138.148 or later; Ubuntu 20.04's 5.15 hardware-enablement kernel needs 5.15.0-138.148~20.04.1 or later. If your kernel is still listed as vulnerable, ask your IT provider to move you to a fixed kernel or unaffected supported release.","product":"Linux kernel (watch_queue event notification subsystem)","audience":"both","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2022-0995"],"tags":["linux","kernel","ubuntu","privilege-escalation","actively-exploited"],"affected":["Linux kernel watch_queue event notification subsystem before the fix identified in Linux 5.17-rc8; distribution patch status varies","Ubuntu 22.04 LTS linux package before 5.15.0-138.148","Ubuntu 20.04 LTS linux-hwe-5.15 package before 5.15.0-138.148~20.04.1","Ubuntu 20.04 LTS, 18.04 LTS, 16.04 LTS and 14.04 LTS linux packages: listed as vulnerable by Canonical"],"fixed":["Linux 5.17-rc8 (upstream fix identified by Red Hat)","Ubuntu 22.04 LTS linux: 5.15.0-138.148","Ubuntu 20.04 LTS linux-hwe-5.15: 5.15.0-138.148~20.04.1"],"matches":[{"platform":"linux","app":"Ubuntu 22.04 LTS Linux kernel (linux)","bundle":"linux","fixed":"5.15.0-138.148"},{"platform":"linux","app":"Ubuntu 20.04 LTS Linux kernel (linux-hwe-5.15)","bundle":"linux-hwe-5.15","fixed":"5.15.0-138.148~20.04.1"},{"platform":"linux","app":"Ubuntu 20.04 LTS Linux kernel (linux)","bundle":"linux","fixed":""},{"platform":"linux","app":"Ubuntu 18.04 LTS Linux kernel (linux)","bundle":"linux","fixed":""},{"platform":"linux","app":"Ubuntu 16.04 LTS Linux kernel (linux)","bundle":"linux","fixed":""},{"platform":"linux","app":"Ubuntu 14.04 LTS Linux kernel (linux)","bundle":"linux","fixed":""}],"sources":[{"kind":"advisory","title":"CVE-2022-0995 — Linux kernel watch_queue flaw","url":"https://access.redhat.com/security/cve/cve-2022-0995","by":"Red Hat","date":""},{"kind":"advisory","title":"Bug 2063786 — CVE-2022-0995 kernel: kernel bug in the watch_queue subsystem","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063786","by":"Red Hat","date":"2022-03-14"},{"kind":"advisory","title":"USN-7455-1: Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-7455-1","by":"Canonical","date":"2025-04-24"},{"kind":"advisory","title":"CISA Adds Six Known Exploited Vulnerabilities to Catalog","url":"https://www.dejavu.org/cgi-bin/get.cgi?url=https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog&ver=93","by":"CISA (mirrored by DejaVu)","date":"2026-08-26"},{"kind":"advisory","title":"CVE-2022-0995 — Ubuntu package status","url":"https://ubuntu.com/security/CVE-2022-0995","by":"Canonical","date":"2026-10-18"}],"started":"2026-08-26","closed":null,"created":"2026-11-03T22:13:48.808Z","updated":"2026-11-03T22:13:48.808Z","cve_notes":[{"cve":"CVE-2022-0995","name":"Out-of-bounds write in Linux kernel watch_queue","what":"A write outside allocated memory in the Linux kernel's watch_queue event notification subsystem could let someone with local access gain higher privileges or crash the system.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-10-18","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Canonical's updated tracker lists Ubuntu 22.04 LTS's main kernel as fixed, but still marks the main kernel packages in Ubuntu 20.04, 18.04, 16.04 and 14.04 as vulnerable. Ubuntu 24.04 LTS's main kernel is listed as unaffected.","url":"https://ubuntu.com/security/CVE-2022-0995","by":"Canonical","patch":"partial"},{"at":"2026-08-26","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2022-0995 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation. The alert did not identify attackers or victims.","url":"https://www.dejavu.org/cgi-bin/get.cgi?url=https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog&ver=93","by":"CISA (mirrored by DejaVu)","patch":null},{"at":"2025-04-24","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Canonical published Ubuntu kernel updates covering CVE-2022-0995, including 5.15.0-138.148 for Ubuntu 22.04 LTS and 5.15.0-138.148~20.04.1 for Ubuntu 20.04 LTS's hardware-enablement kernel. A restart is required.","url":"https://ubuntu.com/security/notices/USN-7455-1","by":"Canonical","patch":"partial"},{"at":"2022-03-14","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Red Hat recorded a Linux watch_queue memory corruption flaw that could let a local user gain higher privileges or crash the system. Its tracker identifies Linux 5.17-rc8 as containing the fix.","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063786","by":"Red Hat","patch":null}],"url":"https://hard.fyi/live/linux-watch-queue-exploited-aug-2026/","json":"https://hard.fyi/api/live?id=linux-watch-queue-exploited-aug-2026"}