Medium 6.6Known exploited (CISA KEV)Published Jan 25, 2022

CVE-2021-22600Double Free in net/packet/af_packet.c leading to priviledge escalation

Updated under an hour ago (Oct 27, 2026, 4:23 PM ET)

Does this affect you?

It affects Linux Kernel Kernel and 11 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Apr 11, 2022; federal agencies had to remediate by May 2, 2022. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux Kernel Kernel

Exploited in the last 30 days

A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755

CVSS: 6.6 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H
Weakness (CWE): CWE-415
Known exploited: Added to CISA KEV Apr 11, 2022; federal remediation due May 2, 2022Apply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 6.59% (percentile 94)
Assigned by: Google
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Kernel Kernel linux_kernel:kernel (from the name)	from unspecified before 5.4.168; from unspecified before 5.10.88; from unspecified before 5.15.11; from unspecified before 5.16-rc6	CNA record
netapp 8300_firmware netapp:8300_firmware	all versions	NVD
netapp 8700_firmware netapp:8700_firmware	all versions	NVD
netapp a400_firmware netapp:a400_firmware	all versions	NVD
netapp c400_firmware netapp:c400_firmware	all versions	NVD
linux linux_kernel linux:linux_kernel	from 4.14.175 before 4.14.259; from 4.19.114 before 4.19.222; from 5.4.29 before 5.4.168; from 5.5.14 before 5.10.88; from 5.11 before 5.15.11	NVD
debian debian_linux debian:debian_linux	9.0; 10.0	NVD
netapp h410c_firmware netapp:h410c_firmware	all versions	NVD
netapp h300s_firmware netapp:h300s_firmware	all versions	NVD
netapp h500s_firmware netapp:h500s_firmware	all versions	NVD
1–10 of 12

References

References

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=ec6af094ea28f0f2dda1a6a33b14cd57e36a9755	mailing-list, patch
https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html	mailing-list, third-party-advisory
https://www.debian.org/security/2022/dsa-5096	vendor-advisory, third-party-advisory
https://security.netapp.com/advisory/ntap-20230110-0002/	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22600	us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.