NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Linux kernel cgroups flaw CVE-2022-0492 used in attacks; fixes available since 2022

Attackers are using an old Linux kernel flaw to gain administrative control, including escaping some containers. Fixes date from 2022. Update Linux computers and container hosts through their vendor, then restart; replace obsolete systems.

What to do

If you use a Linux computer, install its distribution's current kernel security updates and restart. Ask whoever manages your servers or containers to confirm that the host kernel includes the CVE-2022-0492 fix; updating container applications alone does not update that kernel. Move obsolete Linux installations to a maintained release.

Check your devices
  • Fedora Linux kernel (5.16 branch)fixed in 5.16.6 and later
  • Ubuntu 20.04 LTS Linux kernel (5.4 branch)fixed in 5.4.0-105.119 and later
  • Ubuntu 18.04 LTS Linux kernel (4.15 branch)fixed in 4.15.0-173.182 and later
  • Ubuntu 16.04 LTS Linux kernel (4.4 branch)fixed in 4.4.0-222.255 and later
  • Ubuntu 14.04 LTS Linux kernel (base package)no fixed version yet

What’s happening

CVE-2022-0492 is a missing permission check in the Linux kernel's cgroups v1 release_agent feature. An attacker already running code on an affected machine can gain administrative control; some container configurations also allow escape to the host. Unit 42 says standard container protections such as Seccomp, AppArmor and SELinux block the container escape paths it examined. The flaw was disclosed in February 2022, and Linux distributions shipped fixes that year. CISA confirmed exploitation on 2 June 2026, more than four years later. Its catalogue does not identify victims or attackers and lists ransomware involvement as unknown. Released fixes are available for supported affected kernels, but old installations still need attention: Ubuntu's October tracker continues to mark its 14.04 base kernel as vulnerable.

What
Flaw
Affects
Linux kernel cgroups v1 on Linux computers and container hosts
Affected
Linux kernels containing the unpatched cgroups v1 release_agent permission-check flaw; exploitability depends on configuration
Fedora kernels before the vendor's fixed 5.16.6 update
Ubuntu 20.04 LTS linux package before 5.4.0-105.119
Ubuntu 18.04 LTS linux package before 4.15.0-173.182
Ubuntu 16.04 LTS linux package before 4.4.0-222.255
Ubuntu 14.04 LTS base linux package, still listed as vulnerable
Fixed in
Upstream Linux kernel 5.17-rc3
Fedora Linux kernel 5.16.6
Ubuntu 20.04 LTS linux: 5.4.0-105.119
Ubuntu 18.04 LTS linux: 4.15.0-173.182
Ubuntu 16.04 LTS linux: 4.4.0-222.255, available through Ubuntu Pro
CVE
CVE-2022-0492
Since
2 June 2026
Closed
18 Oct 2026

Timeline

  1. UpdateFixed

    Ubuntu's updated tracker lists fixes for older affected kernels and marks Ubuntu 22.04 and newer base kernels as unaffected. The old Ubuntu 14.04 base kernel remains listed as vulnerable.

  2. CISA added

    CISA added CVE-2022-0492 to its Known Exploited Vulnerabilities catalogue, confirming use in real attacks, with a federal remediation deadline of 5 June. Its entry, reproduced by CIRCL, lists ransomware involvement as unknown.

  3. New fix

    Red Hat recorded a fix for Red Hat Enterprise Linux 7.4 Advanced Update Support and closed its tracking bug. Fixes for other RHEL 7 and 8 variants had been recorded earlier.

  4. New fixPartly fixed

    Ubuntu published kernel fixes for additional releases, including 4.15.0-173.182 for Ubuntu 18.04's standard kernel. Its notice requires a restart after updating.

  5. New fixPartly fixed

    Fedora confirmed that its Linux kernel 5.16.6 updates fixed the flaw. Red Hat's tracker also identifies the upstream fix in 5.17-rc3.

  6. Made public

    Linux disclosed CVE-2022-0492, according to Unit 42. Missing permission checks in cgroups v1 could let an attacker gain administrative privileges, including escaping some containers.

Sources

  1. Bug 2051505: cgroups v1 release_agent feature may allow privilege escalationRed Hat · 7 Feb 2022
  2. CVE-2022-0492Canonical · 18 Oct 2026
  3. USN-5339-1: Linux kernel vulnerabilitiesCanonical · 22 Mar 2022
  4. New Linux Vulnerability CVE-2022-0492 Affecting Cgroups: Can Containers Escape?Palo Alto Networks Unit 42 · 7 Mar 2022
  5. NewsBites Volume XXVIII – Issue 42: Flaws in Linux Kernel and Android ExploitedSANS · 5 June 2026
  6. CISA KEV entry: CVE-2022-0492, reproduced by CIRCLCIRCL · 2 June 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from June 2026 · JSON · RSS