Security readout for executives and security teams
Plain-English summary
CVE-2021-22600 is a Linux kernel memory-management flaw that can let a local user gain higher privileges or crash a system. It is not described as remotely exploitable, but CISA KEV listing means exploitation has been observed and remediation should not wait.
Executive priority
Treat as urgent for Linux fleets because it is in CISA KEV and can support privilege escalation after local access. Remediation is most important on shared systems, high-value servers, and environments where initial access could become full host control.
Technical view
The issue is a double free in packet_set_ring() in net/packet/af_packet.c. A local low-privileged user can trigger it through crafted syscalls, with potential privilege escalation or denial of service. The cited fix is Linux commit ec6af094ea28f0f2dda1a6a33b14cd57e36a9755.
Likely exposure
Exposure is tied to Linux kernel versions missing the referenced fix. The bundle does not provide exact upstream affected version ranges, so validation should rely on OS and appliance vendor advisories, especially Debian and NetApp guidance.
Exploitation context
CISA KEV marks this CVE as known exploited. The public bundle does not describe exploitation scale, threat actors, or exploit availability. The attack path requires local access and crafted syscalls, so systems permitting untrusted local code are higher priority.
Researcher notes
Evidence supports a local Linux kernel double-free in AF_PACKET. Exact affected upstream version ranges are incomplete in the bundle. CVSS lists high complexity and user interaction, but the description only states crafted local syscalls; do not assume more without vendor detail.
Mitigation direction
- Upgrade Linux kernels to versions containing commit ec6af094ea28f0f2dda1a6a33b14cd57e36a9755.
- Apply Debian DSA-5096 or DLA 2941-1 packages where Debian kernels are in scope.
- Review the NetApp advisory for affected products and vendor remediation guidance.
- Prioritize systems where untrusted users can execute local code.
Validation and detection
- Inventory Linux kernel versions across servers, workstations, and appliances.
- Compare installed packages against vendor advisories for CVE-2021-22600.
- Confirm whether the kernel source or package includes the referenced fix commit.
- Check vulnerability scanners for authenticated kernel package detection, not only banner data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-415: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-22600 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.6 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H0.85.3Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.6MediumVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=ec6af094ea28f0f2dda1a6a33b14cd57e36a9755CVE reference
- [debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security updateCVE reference · mailing-list
- DSA-5096CVE reference · vendor-advisory
- https://security.netapp.com/advisory/ntap-20230110-0002/CVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22600CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Double Free
Double Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.