Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-2503

18
FAUCET Score

CVE-2022-2503 is a privilege escalation vulnerability affecting the Linux kernel's dm-verity and LoadPin mechanisms. A local attacker with root privileges can bypass LoadPin's verification by reloading device-mapper tables, allowing the loading of untrusted kernel modules and firmware. This vulnerability has a CVSS score of 6.7 (Medium) due to its high impact on confidentiality, integrity, and availability, despite requiring high privileges and local access. There is currently no public exploit code available, nor is there evidence of active exploitation or significant community discussion.

Impacted Technologies

VendorProductVersion(s)CPE
< 5.19CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

6.9MEDIUM

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
0.6
Impact Score
5.8
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.36%
Probability of exploitation in next 30 days
EPSS Percentile
28.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0036 is in the 77th percentile among its peer group of 3,720 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (13)

github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: 18605-16820Fixed in: 5.10.145.1-1
microsoftpatch availablevia msrc
Product: 18617-16823Fixed in: 5.15.67.1-4
microsoftpatch availablevia msrc
Product: cbl2 kernel 5.15.67.1-4 on CBL Mariner 2.0Fixed in: 5.15.67.1-4
microsoftpatch availablevia msrc
Product: cm1 kernel 5.10.145.1-1 on CBL Mariner 1.0Fixed in: 5.10.145.1-1
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: kernel-0:4.18.0-372.75.1.el8_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: kernel-0:5.14.0-162.6.1.el9_1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: kernel-rt-0:5.14.0-162.6.1.rt21.168.el9_1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8Fixed in: kernel-0:4.18.0-372.75.1.el8_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: kernel-rt-0:4.18.0-425.3.1.rt7.213.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: kernel-0:4.18.0-425.3.1.el8
View patch
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: kernel
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: kernel-rt

Vendor Advisories (2)

redhatCVE-2022-2503Moderate

kernel: LoadPin bypass via dm-verity table reload

Aug 12, 2022
microsoft2022-Aug/CVE-2022-2503Moderate

Linux Kernel LoadPin bypass via dm-verity table reload

Aug 9, 2022

References

github.com / google/security-research/security/advisories/GHSA-6vq3-w69p-w63m
ExploitPatchThird Party Advisory
security.netapp.com / advisory/ntap-20230214-0005