Linux Kernel CVE-2022-2602

Requires local, authenticated access with low privileges (PR:L) on an affected Linux kernel, plus the ability to use io_uring and pass file descriptors over Unix domain sockets (SCM_RIGHTS) - the standard, default-available kernel interfaces whose interaction triggers the UAF in SCM garbage collection. No special non-default kernel configuration is named in the description, but exploitation is materially limited by high attack complexity (AC:H): the attacker must win a timing race in the garbage collector and perform reliable heap grooming, so success is probabilistic and may require many attempts. There is no remote vector and no network-facing exposure (AV:L), and no user interaction is required (UI:N). Environments that disable or restrict io_uring (e.g. via sysctl/seccomp) or that do not run untrusted local code materially reduce exposure.

This is a genuine but conditional priority, best characterized as a local privilege-escalation primitive rather than a remotely-wormable threat. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) confirms it requires local access with already-held low privileges and involves a high-complexity trigger - consistent with a use-after-free (CWE-416) rooted in a race between io_uring and the Unix socket SCM garbage collector, which demands precise timing/heap grooming. Impact is maximal (C:H/I:H/A:H), appropriate for a kernel UAF that can yield arbitrary kernel code execution and full host compromise. Exploitation signals are mixed: a POC is publicly available and EPSS sits at 1.44% (81st percentile - elevated relative to the overall CVE population but still an absolute low probability), yet the vuln is NOT listed in CISA KEV, so there is no confirmation of active exploitation. The AC:H rating and local-only vector temper the EPSS percentile: mass, automated exploitation is unlikely, but a skilled local attacker or post-compromise actor can realistically weaponize the public POC for container escape or root escalation. Net: treat as a high-priority patch for multi-tenant, container, and shared Linux hosts where untrusted local code runs; lower urgency for single-tenant systems with no untrusted local access.

A low-privileged local user (or code inside a container) crafts file-descriptor passing over Unix domain sockets combined with io_uring operations to trigger a use-after-free during SCM garbage collection, then grooms the kernel heap to reclaim the freed object and hijack kernel control flow for privilege escalation to root. Publicly available exploit code exists (referenced via Packet Storm and a cve-search exploit link), lowering the practical barrier. The high attack complexity means the race must be won reliably, so exploitation typically requires repeated attempts and careful heap manipulation.