← Back to Vulnerability Reports CVE Intelligence

CVE-2022-0492

Linux Kernel•HIGH · CVSS 7.8• In the wild In CISA KEV

What is CVE-2022-0492?

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

CVSS7.8 NVD 3.1

SeverityHIGH

Exploitation In the wild In CISA KEV

EPSS6% · P93

Triage statusActive Exploit

ActionPatch immediately

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWECWE-287, CWE-862

NVD published2022-03-03

NVD last modified2026-06-17

Timeline

2022-03-03Published to the U.S. National Vulnerability Database (NVD)
2026-06-02Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
2026-06-05CISA federal remediation deadline (BOD 22-01)
2026-06-17NVD record last updated

CISA Known Exploited Vulnerability

Linux Kernel Improper Authentication Vulnerability

Added to KEV2026-06-02

Federal patch deadline2026-06-05

Known ransomware useUnknown

Affected product

Linux Kernel

NVD also lists CPE entries for: Redhat Codeready Linux Builder, Redhat Codeready Linux Builder For Power Little Endian, Redhat Virtualization Host, Redhat Enterprise Linux, Redhat Enterprise Linux Eus

Remediation Steps

Identify Linux systems running vulnerable kernel versions
Apply the latest stable kernel update from your distribution's repository
Reboot systems to activate patched kernel
Verify kernel version post-reboot using 'uname -r'
Prioritize kernel patching for systems exposed to untrusted local users or containers

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 5 of June 2026 (June 29 – July 5)
Vulnerability Priority Report – Week 4 of June 2026 (June 22 – 28)
Vulnerability Priority Report – Week 3 of June 2026 (June 15 – 21)
Vulnerability Priority Report – Week 2 of June 2026 (June 8 – 14)
Vulnerability Priority Report – Week 1 of June 2026 (June 1 – 7)

Related vulnerabilities

CVE-2026-34486 – Apache Tomcat (same product)
CVE-2026-53362 – Linux Kernel (same product)
CVE-2026-53266 – Linux Kernel (same product)
CVE-2026-31431 – Linux Kernel (same product)
CVE-2025-39964 – Linux Kernel (same product)
CVE-2025-39682 – Linux Kernel (same product)

Linux: 31 known exploited vulnerabilities (CISA KEV) →

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.