CVE-2022-29581: canonical ubuntu_linux Improper Update of Reference Count
Vulnerability summary
CVE-2022-29581 is a high (CVSS 7.8) Improper Update of Reference Count vulnerability in canonical ubuntu_linux. EPSS estimates a 0.93% chance of exploitation in the next 30 days, higher than 60.5% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 42 · Related 32Timeline
- 17-05-2022PublishedVulnerability first disclosed.
- 21-04-2025Last modifiedVulnerability information updated.
Description
Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.93%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.93% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu73 products
- linux< 5.4.0-113.127 | < 5.15.0-33.34 | < 4.15.0-180.189
- linux-aws< 5.4.0-1075.80 | < 5.15.0-1008.10 | < 4.15.0-1130.139
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
- linux-aws-5.13< 5.13.0-1025.27~20.04.1
Debian2 products
- linux< 5.17.6-1
- debian_linuxEOL10.0
Linux2 products
- kernel≥ unspecified, < 5.18 | ≥ 4.14, < unspecified
- linux_kernel≥ 4.14, < 4.14.278 | ≥ 4.15, < 4.19.241 | ≥ 4.20, < 5.4.191 | ≥ 5.5, < 5.10.113 | ≥ 5.11, < 5.15.36 | ≥ 5.16, < 5.17.5
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 20.04 | 22.04
5 vendors · 86 products
References
16 links- www.openwall.com/lists/oss-security/2022/05/18/2Mailing ListX Refsource MLISTPatchThird Party Advisory
- packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.htmlX Refsource MISCThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/168191/Kernel-Live-Patch-Security-Notice-LSN-0089-1.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
