PageJack Exploits CVE‑2022‑0995: Linux Kernel Use‑After‑Free Enables Privilege Escalation

PageJack Exploits CVE‑2022‑0995: Linux Kernel Use‑After‑Free Enables Privilege Escalation

What It Is — PageJack is a 2024‑era Linux kernel exploitation technique that creates a use‑after‑free (UAF) in the kernel’s page allocator. The technique is applied to CVE‑2022‑0995, an out‑of‑bounds write in the watch_queue_set_filter() path of Linux kernels 5.17 and newer, allowing a local attacker to gain root privileges.

Exploitability — A full proof‑of‑concept exploit is published in the Quarkslab blog (Mar 2026) and has been verified on multiple distributions. No active ransomware or malware campaigns are known, but the exploit is publicly available and can be incorporated into attacker toolkits. CVSS v3.1 base 8.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected Products — Linux kernel 5.17 + (e.g., Ubuntu 22.04 LTS, RHEL 9, Debian 12, SUSE 15 SP4, and any custom Linux‑based appliances that ship these or later kernels).

TPRM Impact —

• Any third‑party cloud VM, container host, or managed Kubernetes node running a vulnerable kernel is at risk of a local privilege escalation that can be leveraged for lateral movement or data exfiltration.
• SaaS providers that rely on Linux‑based infrastructure may experience service disruption or unauthorized access to customer data.
• Embedded and IoT devices using recent Linux kernels could be compromised, creating downstream supply‑chain exposure.

Recommended Actions —

1. Patch Immediately – Deploy kernel updates that back‑port the fix for CVE‑2022‑0995 (e.g., Linux 5.17.13, 5.18.6, or later).
2. Validate Kernel Versions – Inventory all Linux hosts (including cloud, on‑prem, and edge) and verify they run a patched kernel.
3. Apply Runtime Mitigations – Enable SELinux/AppArmor, enforce kernel.kptr_restrict, and consider using grsecurity or bpf‑based hardening to limit arbitrary kernel memory writes.
4. Monitor for Exploit Activity – Deploy EDR/YARA rules that detect the characteristic IOC_WATCH_QUEUE_SET_FILTER ioctl pattern and the PageJack payload.
5. Review Third‑Party Contracts – Ensure vendors provide timely kernel patching guarantees and disclose any known exposures.

Source: Quarkslab Blog – PageJack in Action (CVE‑2022‑0995)