CVE-2022-1011

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.

• CWE-416
• CWE-416

• https://bugzilla.redhat.com/show_bug.cgi?id=2064855Issue Tracking, Third Party Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git/commit/?h=for-nextVendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/07/msg00000.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5173Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2064855Issue Tracking, Third Party Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git/commit/?h=for-nextVendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/07/msg00000.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5173Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory

Published

Mar 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1005The WP Statistics WordPress plugin before 13.2.2 does not sa…6.1
• CVE-2022-1006The Advanced Booking Calendar WordPress plugin before 1.7.1 …7.2
• CVE-2022-1007The Advanced Booking Calendar WordPress plugin before 1.7.1 …6.1
• CVE-2022-1008The One Click Demo Import WordPress plugin before 3.1.0 does…7.2
• CVE-2022-1009The Smush WordPress plugin before 3.9.9 does not sanitise an…6.1
• CVE-2022-1010The Login using WordPress Users ( WP as SAML IDP ) WordPress…4.8
• CVE-2022-1012A memory leak problem was found in the TCP source port gener…8.2
• CVE-2022-1013The Personal Dictionary WordPress plugin before 1.3.4 fails …9.8
• CVE-2022-1014The WP Contacts Manager WordPress plugin through 2.2.4 fails…9.8
• CVE-2022-1015A flaw was found in the Linux kernel in linux/net/netfilter/…6.6
• CVE-2022-1016A flaw was found in the Linux kernel in net/netfilter/nf_tab…5.5
• CVE-2022-1018When opening a malicious solution file provided by an attack…5.5