{"id":"linux-cgroups-privilege-escalation-jun-2026","category":"patch","status":"closed","title":"Linux kernel cgroups flaw CVE-2022-0492 used in attacks; fixes available since 2022","tldr":"Attackers are using an old Linux kernel flaw to gain administrative control, including escaping some containers. Fixes date from 2022. Update Linux computers and container hosts through their vendor, then restart; replace obsolete systems.","summary":"CVE-2022-0492 is a missing permission check in the Linux kernel's cgroups v1 release_agent feature. An attacker already running code on an affected machine can gain administrative control; some container configurations also allow escape to the host. Unit 42 says standard container protections such as Seccomp, AppArmor and SELinux block the container escape paths it examined. The flaw was disclosed in February 2022, and Linux distributions shipped fixes that year. CISA confirmed exploitation on 2 June 2026, more than four years later. Its catalogue does not identify victims or attackers and lists ransomware involvement as unknown. Released fixes are available for supported affected kernels, but old installations still need attention: Ubuntu's October tracker continues to mark its 14.04 base kernel as vulnerable.","action":"If you use a Linux computer, install its distribution's current kernel security updates and restart. Ask whoever manages your servers or containers to confirm that the host kernel includes the CVE-2022-0492 fix; updating container applications alone does not update that kernel. Move obsolete Linux installations to a maintained release.","product":"Linux kernel cgroups v1 on Linux computers and container hosts","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2022-0492"],"tags":["linux","kernel","ubuntu","fedora","privilege-escalation","container-escape","actively-exploited"],"affected":["Linux kernels containing the unpatched cgroups v1 release_agent permission-check flaw; exploitability depends on configuration","Fedora kernels before the vendor's fixed 5.16.6 update","Ubuntu 20.04 LTS linux package before 5.4.0-105.119","Ubuntu 18.04 LTS linux package before 4.15.0-173.182","Ubuntu 16.04 LTS linux package before 4.4.0-222.255","Ubuntu 14.04 LTS base linux package, still listed as vulnerable"],"fixed":["Upstream Linux kernel 5.17-rc3","Fedora Linux kernel 5.16.6","Ubuntu 20.04 LTS linux: 5.4.0-105.119","Ubuntu 18.04 LTS linux: 4.15.0-173.182","Ubuntu 16.04 LTS linux: 4.4.0-222.255, available through Ubuntu Pro"],"matches":[{"platform":"linux","app":"Fedora Linux kernel (5.16 branch)","bundle":"","fixed":"5.16.6"},{"platform":"linux","app":"Ubuntu 20.04 LTS Linux kernel (5.4 branch)","bundle":"","fixed":"5.4.0-105.119"},{"platform":"linux","app":"Ubuntu 18.04 LTS Linux kernel (4.15 branch)","bundle":"","fixed":"4.15.0-173.182"},{"platform":"linux","app":"Ubuntu 16.04 LTS Linux kernel (4.4 branch)","bundle":"","fixed":"4.4.0-222.255"},{"platform":"linux","app":"Ubuntu 14.04 LTS Linux kernel (base package)","bundle":"","fixed":""}],"sources":[{"kind":"advisory","title":"Bug 2051505: cgroups v1 release_agent feature may allow privilege escalation","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051505","by":"Red Hat","date":"2022-02-07"},{"kind":"advisory","title":"CVE-2022-0492","url":"https://ubuntu.com/security/CVE-2022-0492","by":"Canonical","date":"2026-10-18"},{"kind":"advisory","title":"USN-5339-1: Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-5339-1","by":"Canonical","date":"2022-03-22"},{"kind":"research","title":"New Linux Vulnerability CVE-2022-0492 Affecting Cgroups: Can Containers Escape?","url":"https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups/","by":"Palo Alto Networks Unit 42","date":"2022-03-07"},{"kind":"news","title":"NewsBites Volume XXVIII – Issue 42: Flaws in Linux Kernel and Android Exploited","url":"https://www.sans.org/newsletters/newsbites/xxviii-42","by":"SANS","date":"2026-06-05"},{"kind":"advisory","title":"CISA KEV entry: CVE-2022-0492, reproduced by CIRCL","url":"https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/24c752e3-fa89-4224-8712-5e6a98561da6","by":"CIRCL","date":"2026-06-02"}],"started":"2026-06-02","closed":"2026-10-18","created":"2026-11-03T22:22:09.763Z","updated":"2026-11-03T22:22:09.763Z","cve_notes":[{"cve":"CVE-2022-0492","name":"Missing permission check in Linux cgroups v1","what":"A missing permission check in the Linux kernel's cgroups v1 release_agent feature can let an attacker already running code gain administrative privileges and, under certain configurations, escape container isolation.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-10-18","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Ubuntu's updated tracker lists fixes for older affected kernels and marks Ubuntu 22.04 and newer base kernels as unaffected. The old Ubuntu 14.04 base kernel remains listed as vulnerable.","url":"https://ubuntu.com/security/CVE-2022-0492","by":"Canonical","patch":"patched"},{"at":"2026-06-02","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2022-0492 to its Known Exploited Vulnerabilities catalogue, confirming use in real attacks, with a federal remediation deadline of 5 June. Its entry, reproduced by CIRCL, lists ransomware involvement as unknown.","url":"https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/24c752e3-fa89-4224-8712-5e6a98561da6","by":"CIRCL","patch":null},{"at":"2022-06-22","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Red Hat recorded a fix for Red Hat Enterprise Linux 7.4 Advanced Update Support and closed its tracking bug. Fixes for other RHEL 7 and 8 variants had been recorded earlier.","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051505","by":"Red Hat","patch":null},{"at":"2022-03-22","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Ubuntu published kernel fixes for additional releases, including 4.15.0-173.182 for Ubuntu 18.04's standard kernel. Its notice requires a restart after updating.","url":"https://ubuntu.com/security/notices/USN-5339-1","by":"Canonical","patch":"partial"},{"at":"2022-02-10","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Fedora confirmed that its Linux kernel 5.16.6 updates fixed the flaw. Red Hat's tracker also identifies the upstream fix in 5.17-rc3.","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051505","by":"Red Hat","patch":"partial"},{"at":"2022-02-04","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Linux disclosed CVE-2022-0492, according to Unit 42. Missing permission checks in cgroups v1 could let an attacker gain administrative privileges, including escaping some containers.","url":"https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups/","by":"Palo Alto Networks Unit 42","patch":null}],"url":"https://hard.fyi/live/linux-cgroups-privilege-escalation-jun-2026/","json":"https://hard.fyi/api/live?id=linux-cgroups-privilege-escalation-jun-2026"}