CVE-2022-29581

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-05-17 · updated 2026-06-17
Weakness: CWE-911

Description

Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 20.04, 22.04
Debian Linux: 10.0
Linux kernel: from 4.14 before 4.14.278; from 4.15 before 4.19.241; from 4.20 before 5.4.191; from 5.5 before 5.10.113; from 5.11 before 5.15.36; from 5.16 before 5.17.5 — fixed in 4.14.278, 4.19.241, 5.10.113, 5.15.36, 5.17.5, 5.4.191
NetApp H300E Firmware: all versions
NetApp H300S Firmware: all versions
NetApp H410C Firmware: all versions
NetApp H410S Firmware: all versions
NetApp H500E Firmware: all versions
NetApp H500S Firmware: all versions
NetApp H700E Firmware: all versions
NetApp H700S Firmware: all versions

How to fix

Upgrade to a fixed version: Linux kernel 4.14.278, 4.19.241, 5.10.113, 5.15.36. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-29581 or the next vulnerability affects your stack