All vulnerabilities
CVE-2021-22600

Linux Kernel Privilege Escalation Vulnerability

Linux KernelOperating systems
Open in ThreatlineRecord JSON
CVSS
6.6Medium
ExploitationExploited in the wildAdded to KEV 11 Apr 2022CISA KEV
Exploit odds (EPSS)6.59%Chance of exploitation activity in the next 30 days, higher than 93% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.4.168Also 5.10.88, 5.15.11 and 1 moreCVE List
Federal deadline2 May 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 26 Jan 2022, 00:00 UTCPublishedCVE List
  2. 11 Apr 2022Added to CISA KEVCISA KEV

Description

Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.

Text from CVE List

Affected versions 4

  • Kernelaffected: unspecified before 5.4.168CVE List
  • Kernelaffected: unspecified before 5.10.88CVE List
  • Kernelaffected: unspecified before 5.15.11CVE List
  • Kernelaffected: unspecified before 5.16-rc6CVE List

References 6