Security readout for executives and security teams
Plain-English summary
CVE-2022-2327 is a Linux kernel io_uring memory-safety flaw. A low-privileged local user may trigger incorrect reference counting that can cause a double free/use-after-free condition, potentially exposing sensitive data or enabling integrity impact. Business urgency is highest on shared Linux hosts, container platforms, and systems allowing untrusted local code execution.
Executive priority
Prioritize remediation in the normal high-severity kernel patch cycle, escalating for multi-tenant or untrusted-workload environments. There is no cited active exploitation, but the potential confidentiality and integrity impact makes delayed patching risky on shared Linux infrastructure.
Technical view
The flaw is in io_uring work_flags identity handling. Some IORING_OP paths miss required identity types, causing inconsistent reference counts and possible double free, mapped to CWE-416. The CVSS 3.1 score is 7.5, with local attack vector, low privileges required, high complexity, no user interaction, changed scope, and high confidentiality and integrity impact.
Likely exposure
Exposure is likely limited to Linux systems running vulnerable kernels with io_uring available and where low-privileged local users, tenants, or workloads can execute code. The source bundle does not provide exact affected kernel version ranges or CPEs, so version validation must use vendor or distribution advisories.
Exploitation context
The source bundle does not cite active exploitation, and KEV status is false. The CVSS vector indicates exploitation is local, requires low privileges, and has high attack complexity. Treat this as a serious local privilege and isolation risk, not a remotely reachable internet-facing bug based on available evidence.
Researcher notes
The public record names the fix commit but does not provide precise vulnerable version ranges in the supplied bundle. Avoid assuming product exposure beyond Linux Kernel and cited vendor advisories. Validation should focus on kernel provenance, downstream backports, and io_uring availability in local execution contexts.
Mitigation direction
- Upgrade Linux kernels past commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 or vendor backports.
- Apply distribution or appliance vendor kernel security updates when available.
- Check NetApp guidance if using affected NetApp products or appliances.
- Prioritize shared hosts, container infrastructure, CI runners, and multi-user Linux systems.
- Track vendor advisories for exact affected versions and supported remediation paths.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, containers, and host nodes.
- Confirm whether the fix commit or vendor backport is present.
- Review distribution advisories for affected package versions and patch status.
- Identify systems where untrusted local users or workloads can execute code.
- Document exceptions where exact kernel exposure cannot be confirmed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-2327 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N1.15.8Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=df3f3bb5059d20ef094d6b2f0256c4bf4127a859CVE reference
- https://kernel.dance/#df3f3bb5059d20ef094d6b2f0256c4bf4127a859CVE reference
- https://security.netapp.com/advisory/ntap-20230203-0009/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.