ON 26 August 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2022‑0995 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects the Linux kernel, the core component of the Linux operating system. Named the Linux Kernel Out‑of‑Bounds Write Vulnerability, it permits a local user to write beyond the bounds of allocated memory, which can lead to privilege escalation or a denial‑of‑service condition.
The vulnerability is an out‑of‑bounds memory write in the kernel’s memory handling code. An attacker with local access can craft a malicious input that triggers the write, allowing them to execute arbitrary code with kernel privileges or crash the system. The Common Vulnerability Scoring System rates the flaw at 7.8 (High). A patch addressing the issue has been released and is available in the kernel commit 93ce93587d36493f2f86921fa79921b3cba63fbb.
CISA’s inclusion of this CVE in the KEV catalogue indicates that active exploitation has been observed in the wild. No public reports link the flaw to ransomware campaigns at this time. Federal civilian executive branch (FCEB) agencies must apply the required mitigations by the remediation deadline of 9 September 2026.
CISA requires that administrators apply mitigations according to the vendor’s instructions while aligning with BOD 26‑04 Prioritizing Security Updates Based on Risk and the Forensics Triage Requirements. For cloud‑based implementations, follow the applicable BOD 26‑04 guidance or cease using the product if no mitigation can be applied. Stakeholders must assess each asset’s exposure to the internet and ensure patching follows BOD 26‑04 timelines. Although the directive binds FCEB agencies, all organisations should audit their Linux systems for this flaw and apply the available patch promptly.
For full technical details, see the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2022-0995 and the CISA KEV catalogue.