Linux kernel: out-of-bounds write in watch_queue filters lets a local user gain root

Impact

An out-of-bounds write in the watch_queue notification subsystem lets a local user overwrite kernel state, giving privileged access or a crash. Unlike most kernel CVEs in obscure drivers, this one lives in a general-purpose subsystem that unprivileged processes can drive on distributions that enable CONFIG_WATCH_QUEUE, and it is reachable from inside an ordinary container unless the syscall path is filtered - so on a multi-tenant GPU node any pod that can open a pipe and set a watch filter has a route to host root, and from there to every other tenant's GPUs, model weights and fabric credentials. Public write-ups exist and CISA lists it as exploited in the wild, so treat it as weaponised rather than theoretical.

Who can reach it

Local unprivileged user on the host, including a process inside a container that has not had the watch_queue path blocked by seccomp. No special capability is required beyond an ordinary shell or pod.

What to do

Take the distribution kernel that contains commit 93ce93587d36 (fixed before 5.17 final; every maintained distro shipped it in 2022). Applying it means rebooting each node, so drain GPU workloads and checkpoint long training runs first - this is a rolling node-reboot campaign, not a service restart. Where a reboot cannot be scheduled immediately, a seccomp profile that blocks the watch_queue ioctl, or building kernels without CONFIG_WATCH_QUEUE, removes the reachable path.

References

Related entries

• Linux kernel (net/sched cls_route): Use-after-free in the cls_route filterCVE-2022-2588 · Linux kernel (net/sched cls_route)High
• Xen on AMD-Vi - unity map handling on device reassignment: AMD-Vi unity mappings are not correctly torn down orCVE-2022-26358 · Xen on AMD-Vi - unity map handling on device reassignmentHigh
• Xen on AMD-Vi - unity map handling: Second XSA-400 AMD-Vi unity-map issue. Stale or incorrect IOMMU mappings acrossCVE-2022-26359 · Xen on AMD-Vi - unity map handlingHigh
• Xen on AMD-Vi - unity map handling: Third XSA-400 AMD-Vi issue. Same class - IOMMU mappings that outlive theirCVE-2022-26360 · Xen on AMD-Vi - unity map handlingHigh
• Xen on AMD-Vi - unity map handling: Fourth XSA-400 AMD-Vi issue. Patch the set togetherCVE-2022-26361 · Xen on AMD-Vi - unity map handlingHigh
• Linux kernel (IPsec ESP): Buffer overflow in the IPsec ESP transformation code - local rootCVE-2022-27666 · Linux kernel (IPsec ESP)High