What’s Vulnerable › Vulnerabilities

CVE-2022-38014: Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-11-09 · updated 2026-08-10
• Weakness: CWE-362

Description

Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability

Affected products

• Microsoft Azure Iot Edge For Linux: all versions
• Microsoft Windows Subsystem for Linux (WSL2): all versions
• Microsoft Azure EFLOW: from 1.4.0.0 before 1.4.2.12122 LTS — fixed in 1.4.2.12122 LTS
• Microsoft Windows Subsystem for Linux (WSL2): from 5.0.0.0 before 5.15.62.1 — fixed in 5.15.62.1

How to fix

Upgrade to a fixed version: Microsoft Azure EFLOW 1.4.2.12122 LTS; Microsoft Windows Subsystem for Linux (WSL2) 5.15.62.1. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38014
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38014

Get alerted when CVE-2022-38014 or the next vulnerability affects your stack