CVE-2022-0995

What is the Linux kernel watch_queue subsystem?

watch_queue is a Linux kernel event-notification mechanism, introduced around kernel 5.8, that lets user space subscribe to notifications about kernel objects (such as keyring changes) through a special pipe. User space can install a filter describing which notification types it wants to receive. Because the subsystem accepts a user-supplied filter specification and processes it in kernel context, flaws in its bounds handling translate directly into kernel memory-corruption primitives usable for local privilege escalation.

Overview

CVE-2022-0995 is an out-of-bounds write (CWE-787) in the watch_queue_set_filter() path of the Linux kernel's watch_queue subsystem. Due to an incorrect bounds check when processing the user-supplied filter, a local attacker can write beyond the bounds of an allocated kernel object. This heap out-of-bounds write can be shaped into a reliable local privilege-escalation primitive, letting an unprivileged local user gain root, or crash the system (denial of service).

Affected Versions

Kernels built without CONFIG_WATCH_QUEUE are not affected.

Technical Details

The bug is in the filter-installation logic: when copying and validating the user-provided notification filter, the code fails to correctly enforce the maximum number/size of filter entries, allowing more data to be written than the destination buffer can hold — a heap out-of-bounds write. Exploitation is local and requires only unprivileged access (AV:L/PR:L/AC:L), with no user interaction. Because the corrupted allocation is in kernel heap memory, a skilled attacker can groom the heap to overwrite adjacent objects and hijack control flow or corrupt privilege-relevant structures, achieving root. The upstream fix (93ce93587d36, "watch_queue: Fix filter limit check") corrects the bounds validation.

Discovery

The vulnerability was reported and fixed upstream in March 2022 as part of a set of watch_queue hardening changes (the same subsystem that yielded the higher-profile CVE-2022-0185 and CVE-2022-0492-era kernel bugs of that period). The fix landed in mainline via the kernel security process, with distribution vendors backporting it into their supported kernels.

Exploitation Context

Local kernel privilege-escalation bugs of this class are highly valued because they convert any code-execution foothold (a web-shell, a compromised service account, a container escape stepping stone) into full root. Proof-of-concept and weaponised exploits for the 2022 watch_queue bugs have circulated publicly. CISA's August 2026 KEV addition indicates confirmed in-the-wild exploitation against unpatched Linux hosts still running vulnerable 5.8–5.17 kernels. This is a post-initial-access escalation primitive, commonly chained after a remote foothold.

Remediation

1. Update the kernel to a patched build that includes commit 93ce93587d36 (upstream 5.17-rc8 or the stable backports), and reboot. Use your distribution's security-patched kernel package (apt upgrade, dnf update kernel, etc.).
2. As an interim mitigation, if the notification/watch_queue feature is not needed, disable unprivileged access to it — for example restrict CONFIG_WATCH_QUEUE functionality or block the relevant syscalls via seccomp in sandboxed workloads.
3. Prioritize multi-tenant and internet-facing hosts where an attacker is most likely to already have a low-privileged foothold.
4. Harden container workloads with seccomp/AppArmor profiles that restrict the syscalls used to reach watch_queue, reducing escalation options from a compromised container.
5. Hunt for local privilege-escalation indicators — unexpected root processes, kernel oops/crash logs referencing watch_queue, and unauthorized changes made by previously unprivileged accounts.