high 7.8

CVE-2022-1011 json

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write().

published 2022-03-18 4y ago modified 2026-08-26 2mo ago also EUVD-2022-24361

cvss: 7.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits: 0; none known

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.

Patch / fix

fixed in 1 distros 7

linux linux_kernel 4.9.320, 4.14.276, 4.19.238, 5.4.185, 5.10.106, 5.15.29, 5.16.15

debian ubuntu red hat suse almalinux rocky linux azure linux

linux Debian 14, Debian 13, Debian 12 5.16.18-1

debian advisories DEBIAN-CVE-2022-1011

linux Ubuntu 18.04 LTS 4.15.0-189.200
linux Ubuntu 20.04 LTS 5.4.0-117.132
linux-aws Ubuntu 18.04 LTS 4.15.0-1137.148
linux-aws Ubuntu 20.04 LTS 5.4.0-1078.84
linux-gcp Ubuntu 20.04 LTS 5.4.0-1078.84
linux-gke Ubuntu 20.04 LTS 5.4.0-1074.79
linux-ibm Ubuntu 20.04 LTS 5.4.0-1026.29
linux-iot Ubuntu 20.04 LTS 5.4.0-1004.6

ubuntu advisories UBUNTU-CVE-2022-1011

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 8 4.18.0-372.9.1.el8
perf RHEL 8 4.18.0-372.9.1.el8
bpftool RHEL 8 4.18.0-372.9.1.el8
kernel-core RHEL 8 4.18.0-372.9.1.el8
kernel-tools RHEL 8 4.18.0-372.9.1.el8
python3-perf RHEL 8 4.18.0-372.9.1.el8
kernel-modules RHEL 8 4.18.0-372.9.1.el8
kernel-zfcpdump RHEL 8 4.18.0-372.9.1.el8

red hat advisories RHSA-2022:1988 RHSA-2024:5259 RHSA-2022:1975

kernel-syms SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +3 more 4.12.14-150100.197.114.2
kernel-source SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +3 more 4.12.14-150100.197.114.2
kernel-default SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +7 more 4.12.14-150100.197.114.2
kernel-vanilla openSUSE Leap 15.4, openSUSE Leap 15.3 4.12.14-150100.197.114.2
kernel-kvmsmall openSUSE Leap 15.4, openSUSE Leap 15.3 4.12.14-150100.197.114.2
kernel-zfcpdump SLES 15 SP1-LTSS, openSUSE Leap 15.4, openSUSE Leap 15.3 4.12.14-150100.197.114.2
kernel-obs-build SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +3 more 4.12.14-150100.197.114.2
kernel-syms SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +6 more 5.3.18-150200.24.115.1

suse advisories SUSE-SU-2023:0416-1 SUSE-SU-2022:2111-1 SUSE-SU-2022:2104-1 SUSE-SU-2022:2103-1 SUSE-SU-2022:2083-1 SUSE-SU-2022:2082-1

kernel AlmaLinux 8 4.18.0-372.9.1.el8
perf AlmaLinux 8 4.18.0-372.9.1.el8
bpftool AlmaLinux 8 4.18.0-372.9.1.el8
kernel-core AlmaLinux 8 4.18.0-372.9.1.el8
kernel-tools AlmaLinux 8 4.18.0-372.9.1.el8
python3-perf AlmaLinux 8 4.18.0-372.9.1.el8
kernel-modules AlmaLinux 8 4.18.0-372.9.1.el8
kernel-debug-core AlmaLinux 8 4.18.0-372.9.1.el8

almalinux advisories ALSA-2022:1988

kernel Rocky Linux 8 4.18.0-372.9.1.el8
kernel-rt Rocky Linux 8 4.18.0-372.9.1.rt7.166.el8

rocky linux advisories RLSA-2022:1988 RLSA-2022:1975

kernel CBL-Mariner 2.0 5.15.32.1-2

azure linux advisories AZL-9087

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2022-1011 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-1011 updated 2026-11-05 cvss 7.0

kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux 7 kernel-rt, kernel-rt-kvm, kernel-rt-trace, kernel-rt-debug-kvm, kernel-rt-trace-kvm
affected: workaround, no fix available
Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-372.9.1.el8, kernel 4.18.0-372.9.1.el8, bpftool 4.18.0-372.9.1.el8, kernel-core 4.18.0-372.9.1.el8, kernel-tools 4.18.0-372.9.1.el8, python3-perf 4.18.0-372.9.1.el8, +15 more Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-372.9.1.el8, kernel-debuginfo-common-aarch64 4.18.0-372.9.1.el8, kernel-debuginfo-common-ppc64le 4.18.0-372.9.1.el8
fixed: vendor fix RHSA-2022:1988
Red Hat Enterprise Linux NFV (v. 8) kernel-rt 4.18.0-372.9.1.rt7.166.el8, kernel-rt-kvm 4.18.0-372.9.1.rt7.166.el8, kernel-rt-core 4.18.0-372.9.1.rt7.166.el8, kernel-rt-modules 4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-kvm 4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-core 4.18.0-372.9.1.rt7.166.el8, +4 more Red Hat Enterprise Linux RT (v. 8) kernel-rt 4.18.0-372.9.1.rt7.166.el8, kernel-rt-core 4.18.0-372.9.1.rt7.166.el8, kernel-rt-modules 4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-core 4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-modules 4.18.0-372.9.1.rt7.166.el8, kernel-rt-modules-extra 4.18.0-372.9.1.rt7.166.el8, +2 more
fixed: vendor fix RHSA-2022:1975
Red Hat Enterprise Linux Server (v. 7 ELS) perf 3.10.0-1160.123.1.el7, kernel 3.10.0-1160.123.1.el7, bpftool 3.10.0-1160.123.1.el7, python-perf 3.10.0-1160.123.1.el7, kernel-kdump 3.10.0-1160.123.1.el7, kernel-tools 3.10.0-1160.123.1.el7, +7 more Red Hat Enterprise Linux Server Optional (v. 7 ELS) kernel-debuginfo-common-ppc64 3.10.0-1160.123.1.el7, kernel-debuginfo-common-x86_64 3.10.0-1160.123.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-1160.123.1.el7
fixed: vendor fix RHSA-2024:5259
Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-075-01 updated 2023-03-14 cvss 7.8

Siemens SCALANCE, RUGGEDCOM Third-Party

Siemens RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) <V7.2 Siemens RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) <V7.2 Siemens SCALANCE M804PB (6GK5804-0AP00-2AA2) <V7.2 Siemens SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2) <V7.2 Siemens SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2) <V7.2 Siemens SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2) <V7.2

+14 more productsfewer

Siemens SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2) <V7.2 Siemens SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) <V7.2 Siemens SCALANCE M874-2 (6GK5874-2AA00-2AA2) <V7.2 Siemens SCALANCE M874-3 (6GK5874-3AA00-2AA2) <V7.2 Siemens SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2) <V7.2 Siemens SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) <V7.2 Siemens SCALANCE M876-4 (6GK5876-4AA10-2BA2) <V7.2 Siemens SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) <V7.2 Siemens SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) <V7.2 Siemens SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) <V7.2 Siemens SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) <V7.2 Siemens SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) <V7.2 Siemens SCALANCE S615 (6GK5615-0AA00-2AA2) <V7.2 Siemens SCALANCE S615 EEC (6GK5615-0AA01-2AA2) <V7.2

affected: fixed in V7.2 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

1.17% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	4.6	AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

n/a kernel

Classification

Weakness

CWE-416 Use After Free

Technology feeds

Linux kernel rss critical rss

References

debian.org /security/2022/dsa-5173
vendor-advisory, third-party-advisory
git.kernel.org /pub/scm/linux/kernel/git/mszeredi/fuse.git/commit/?h=for-next
vendor-advisory
bugzilla.redhat.com /show_bug.cgi?id=2064855
issue-tracking, third-party-advisory
lists.debian.org /debian-lts-announce/2022/07/msg00000.html
mailing-list, third-party-advisory
oracle.com /security-alerts/cpujul2022.html
third-party-advisory

Sources

CVE List CVE-2022-1011
NVD CVE-2022-1011

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed