Linux kernel CVE-2022-0995 used in attacks; fixes available, but some Ubuntu kernels remain vulnerable
CISA confirms attacks using Linux kernel flaw CVE-2022-0995. Someone already able to run code locally could gain higher privileges or crash the machine. Install your Linux vendor's kernel update and restart; some older Ubuntu kernels remain vulnerable.
If you use Linux, install your distribution's kernel security updates and restart. For Ubuntu 22.04's standard 5.15 kernel, use package version 5.15.0-138.148 or later; Ubuntu 20.04's 5.15 hardware-enablement kernel needs 5.15.0-138.148~20.04.1 or later. If your kernel is still listed as vulnerable, ask your IT provider to move you to a fixed kernel or unaffected supported release.
- Ubuntu 22.04 LTS Linux kernel (linux)fixed in 5.15.0-138.148 and later
- Ubuntu 20.04 LTS Linux kernel (linux-hwe-5.15)fixed in 5.15.0-138.148~20.04.1 and later
- Ubuntu 20.04 LTS Linux kernel (linux)no fixed version yet
- Ubuntu 18.04 LTS Linux kernel (linux)no fixed version yet
- Ubuntu 16.04 LTS Linux kernel (linux)no fixed version yet
- Ubuntu 14.04 LTS Linux kernel (linux)no fixed version yet
What’s happening
CVE-2022-0995 is a memory corruption flaw in watch_queue, the Linux kernel component that handles event notifications. Someone who can already run code locally could use it to gain higher privileges or crash the machine. Red Hat recorded the issue in March 2022 and identifies Linux 5.17-rc8 as fixed; it says none of its shipped kernels were found affected. Canonical released fixes for Ubuntu's 5.15-based kernels in April 2025. CISA confirmed exploitation on 26 August 2026, without publishing campaign or victim details. As of 3 November, patch coverage remains partial: Canonical's October tracker still marks several older Ubuntu kernel packages as vulnerable, although fixes exist for Ubuntu 22.04 and Ubuntu 20.04's 5.15 hardware-enablement kernel. The sources reviewed do not establish when attacks began or whether they have stopped.
- What
- Flaw
- Affects
- Linux kernel (watch_queue event notification subsystem)
- Affected
- Linux kernel watch_queue event notification subsystem before the fix identified in Linux 5.17-rc8; distribution patch status varies
Ubuntu 22.04 LTS linux package before 5.15.0-138.148
Ubuntu 20.04 LTS linux-hwe-5.15 package before 5.15.0-138.148~20.04.1
Ubuntu 20.04 LTS, 18.04 LTS, 16.04 LTS and 14.04 LTS linux packages: listed as vulnerable by Canonical - Fixed in
- Linux 5.17-rc8 (upstream fix identified by Red Hat)
Ubuntu 22.04 LTS linux: 5.15.0-138.148
Ubuntu 20.04 LTS linux-hwe-5.15: 5.15.0-138.148~20.04.1 - Since
- 26 Aug 2026
Timeline
- Vendor revisedPartly fixed
Canonical's updated tracker lists Ubuntu 22.04 LTS's main kernel as fixed, but still marks the main kernel packages in Ubuntu 20.04, 18.04, 16.04 and 14.04 as vulnerable. Ubuntu 24.04 LTS's main kernel is listed as unaffected.
- CISA added
CISA added CVE-2022-0995 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation. The alert did not identify attackers or victims.
- New fixPartly fixed
Canonical published Ubuntu kernel updates covering CVE-2022-0995, including 5.15.0-138.148 for Ubuntu 22.04 LTS and 5.15.0-138.148~20.04.1 for Ubuntu 20.04 LTS's hardware-enablement kernel. A restart is required.
- Made public
Red Hat recorded a Linux watch_queue memory corruption flaw that could let a local user gain higher privileges or crash the system. Its tracker identifies Linux 5.17-rc8 as containing the fix.
Sources
- CVE-2022-0995 — Linux kernel watch_queue flawRed Hat
- Bug 2063786 — CVE-2022-0995 kernel: kernel bug in the watch_queue subsystemRed Hat · 14 Mar 2022
- USN-7455-1: Linux kernel vulnerabilitiesCanonical · 24 Apr 2025
- CISA Adds Six Known Exploited Vulnerabilities to CatalogCISA (mirrored by DejaVu) · 26 Aug 2026
- CVE-2022-0995 — Ubuntu package statusCanonical · 18 Oct 2026