Is CVE-2022-21505 being actively exploited?

CVE-2022-21505 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2022-21505?

CVE-2022-21505 has a CVSS 3.1 base score of 6.7 (MEDIUM).

CVE-2022-21505

MEDIUM · CVSS 6.7EPSS 0.2%EU EUVD

In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Key facts

CVSS score: 6.7 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-346
EPSS score: 0.2% (9th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2022-26729)
Published: December 24, 2024
NVD last modified: October 14, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2022-26729 in the EU Vulnerability Database. Last updated in EUVD on October 14, 2026.

View on the EU Vulnerability Database

Affected products

oracle / linux
oracle / linux
oracle / linux

Certified products that may be affected

33 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Oracle Linux 9 NSS Cryptographic Module - Oracle Corporation - FIPS 140 5339 - active
Oracle Linux 9 OpenSSL FIPS Provider - Oracle Corporation - FIPS 140 5294 - active
Oracle Linux 9 Kernel Crypto API Cryptographic Module - Oracle Corporation - FIPS 140 5036 - active
Oracle Linux 9 GnuTLS Cryptographic Module - Oracle Corporation - FIPS 140 5037 - active
Oracle Linux 9 libgcrypt Cryptographic Module - Oracle Corporation - FIPS 140 4993 - active

See all 33 in the Security Certifications Explorer.

References

https://cert-portal.siemens.com/productcert/html/ssa-794697.html
https://git.kernel.org/linus/543ce63b664e2c2f9533d089a4664b559c3e6b5b(Broken Link)
https://linux.oracle.com/cve/CVE-2022-21505.html(Vendor Advisory)

Last updated October 16, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain