CVE-2021-22600: Linux Kernel Privilege Escalation Vulnerability

High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2022-04-11. EPSS: 6.6% chance of exploitation in the next 30 days.

A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Linux Linux Kernel: from 4.14.175, before 4.14.259 (fixed in 4.14.259); from 4.19.114, before 4.19.222 (fixed in 4.19.222); from 5.4.29, before 5.4.168 (fixed in 5.4.168); from 5.5.14, before 5.10.88 (fixed in 5.10.88); from 5.11, before 5.15.11 (fixed in 5.15.11)
• Netapp 8300 Firmware: affected versions not specified
• Netapp 8700 Firmware: affected versions not specified
• Netapp a400 Firmware: affected versions not specified
• Netapp c400 Firmware: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410c Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified

Published 2022-01-26. Last modified 2026-06-17.