CISA Adds Four-Year-Old Linux Kernel cgroups Container-Escape Flaw CVE-2022-0492 to KEV Catalog Citing Active Exploitation
CISA added the 2022 Linux kernel cgroups release_agent flaw CVE-2022-0492 to its KEV catalog on June 2, 2026, with a June 5 federal patch deadline.
Overview
The U.S. Cybersecurity and Infrastructure Security Agency added a four-year-old Linux kernel privilege-escalation flaw to its Known Exploited Vulnerabilities catalog on June 2, 2026, urging federal agencies to patch it by June 5, according to SecurityWeek. The vulnerability, tracked as CVE-2022-0492, lives in the Linux kernel’s cgroups v1 subsystem and can let a local attacker break out of a container and gain root on the host. Technical details were published roughly three years ago, but its in-the-wild exploitation was reported only this week, SecurityWeek said.
What We Know
CVE-2022-0492 carries a CVSS 3.1 base score of 7.8, rated High, according to the National Vulnerability Database. The NVD describes it as a vulnerability in “the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function” that “under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.” The NVD classifies the weakness as CWE-862, Missing Authorization, and its vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a local attack vector requiring low privileges.
The cgroups v1 release_agent feature lets administrators configure a program that runs when a process group terminates. As BleepingComputer explains, the flaw “lies in the ‘cgroup_release_agent_write()’ function of the cgroups v1 subsystem, which, due to insufficient authentication checks, can be abused by a local attacker to bypass namespace isolation, escalate privileges, and potentially escape from a container to gain root-level access on the host system.” Per SecurityWeek, an attacker who already has code execution inside a container can place a malicious script on the host filesystem “that will be run as root as part of the cgroup notification process, essentially allowing for a container escape and privilege escalation.”
CISA set the patch deadline for June 5 for federal agencies bound by Binding Operational Directive 22-01, which requires them to apply the vendor-provided updates, BleepingComputer reported. The same KEV update also added an Android Framework vulnerability, CVE-2025-48595, with the same deadline, according to BleepingComputer.
The flaw is not new. Unit 42 researcher Yuval Avrahami documented it on March 3, 2022, noting that “On Feb. 4, Linux announced CVE-2022-0492, a new privilege escalation vulnerability in the kernel,” according to Palo Alto Networks Unit 42. It was patched in the kernel shortly afterward. What changed in 2026 is the KEV listing, which signals that CISA has evidence the long-fixed bug is being abused against systems that were never updated.
What We Don’t Know
The public record does not name the threat actors or victims. SecurityWeek attributes the renewed attention to a Kaspersky blog post about attacks on container environments, but notes that specific threat actors and victims remain unnamed. That Kaspersky write-up, “Containers on fire: from container escapes to supply chain attacks,” published June 1, 2026, presents CVE-2022-0492 as one example of a container-escape vector, describing it as “a critical Linux kernel vulnerability that allows for container escape and arbitrary command execution on the host system” whose root cause “stemmed from improper privilege validation when interacting with the cgroups release_agent mechanism,” according to Kaspersky. The article does not detail a specific named campaign.
CISA’s catalog entry confirms active exploitation but does not publish indicators of compromise or victim counts. The scope of unpatched, exposed systems is also unclear.
Analysis
KEV additions for old, long-patched vulnerabilities are a recurring pattern: the fix exists, but legacy container hosts, embedded systems, and neglected kernels never received it. CVE-2022-0492 is specific to cgroups v1, and the exploitation path depends on host configuration. According to Aqua Security, the flaw is “a weakness in the handling of release_agent in cgroups” that “could allow for container escape under some circumstances,” and “when user namespaces are enabled on the host, exploitation can be easier.”
Default container defenses blunt the attack. Aqua Security researcher Rory McCune wrote that “both the Docker default seccomp filter and AppArmor policy will block the exploitation of the vulnerability. Only if both are disabled does exploitation become possible,” according to Aqua Security. The same guidance holds four years later: organizations should confirm hosts are patched and rebooted onto a fixed kernel, keep seccomp and mandatory-access-control policies enabled, and migrate off cgroups v1 where feasible.