VulnSocial
← Back to blog

CVE-2022-0492 – High‑Severity Linux Kernel Privilege‑Escalation & Container Escape

Key takeaways

  • Severity: High (CVSS 7.8)
  • Impact: Privilege escalation & container escape via cgroup v1 release_agent
  • Affected: Major Linux distributions (Ubuntu, Debian, Red Hat, Fedora, etc.)
  • Status: Actively exploited; listed in CISA KEV
  • Action: Apply vendor patches immediately and enforce mitigation guidance

Overview

The Linux kernel vulnerability identified as CVE-2022-0492 resides in the cgroup v1 release_agent implementation (function cgroup_release_agent_write in kernel/cgroup/cgroup‑v1.c). An attacker who can write to this file can trigger arbitrary code execution with kernel privileges, effectively bypassing namespace isolation and escaping containers. The flaw is classified as Improper Authentication (CWE‑862, CWE‑287) and carries a CVSS 3.1 base score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Exploits target cloud‑native workloads, container platforms, and any Linux host that still uses cgroups v1.

Technical Details

cgroups (control groups) allow the kernel to limit and isolate resource usage for a set of processes. The release_agent attribute can be set to a user‑space binary that the kernel executes when the last process in a cgroup exits. The vulnerability stems from insufficient authentication checks when writing to release_agent. An unprivileged user who can mount a cgroup v1 hierarchy and write a malicious path to release_agent can cause the kernel to execute that binary with root privileges.

Typical exploitation steps:

  1. Create a new cgroup hierarchy under /sys/fs/cgroup/....
  2. Write a malicious executable path to release_agent.
  3. Trigger the release by terminating the last process in the cgroup.
  4. The kernel runs the attacker‑controlled binary as root, enabling a full container escape or host takeover.

Because the attack works from within a container that has access to the host’s cgroup filesystem (a common misconfiguration), it breaks the isolation model that container runtimes rely on.

Severity & Impact

  • CVSS 3.1 Base Score: 7.8 (High)
  • Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CIA Impact: Confidentiality, Integrity, and Availability are all High (complete system compromise).
  • CWE: CWE‑862 (Improper Authentication), CWE‑287 (Improper Authentication)

The combination of low attack complexity, local access, and the ability to gain root on the host makes this a critical priority for any environment that runs Linux containers or virtual machines.

Affected Products

The vulnerability is present in the upstream Linux kernel and therefore affects any distribution shipping an unpatched kernel version. Notable affected vendors include:

  • Canonical – Ubuntu 14.04 ESM, 16.04 ESM, 18.04 LTS, 20.04 LTS, 22.04 LTS
  • Debian – Debian 9, 10, 11
  • Red Hat – Enterprise Linux 8 (all minor releases), RHEL 7
  • Fedora – Fedora 35
  • NetApp – Bootstrap OS, H300s, H410c, H410s, H500s, H700s, HCI Compute Node, SolidFire storage nodes

For the exhaustive list of affected products, versions, and CPE identifiers, see the official CVE page: https://vulnsocial.com/cve/CVE-2022-0492.

Actionable Insights – What to Do Now

  • Monitor: Look for any writes to */cgroup.release_agent in your host and container logs. Unusual activity is a strong indicator of exploitation attempts.
  • Audit: Verify that no containers are running with privileged access to the host’s /sys/fs/cgroup mount. Use the docker inspect or podman inspect output to confirm Privileged is false and cgroupfs is not shared.
  • Disable cgroup v1: If your workload supports it, switch to cgroups v2 (systemd.unified_cgroup_hierarchy=1 kernel parameter) which removes the release_agent feature.
  • Restrict write access: Ensure that only the root user can write to release_agent. On hosts, set the appropriate file permissions (chmod 600 /sys/fs/cgroup/.../release_agent).
  • Apply mitigations: Follow vendor guidance for kernel updates and live patches (see Remediation section).

Remediation & Mitigation

  1. Update the kernel to a version that includes the fix. See the vendor patch references for exact version numbers. 
    # Example for Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-generic
  2. Apply vendor live‑patches if you cannot reboot immediately:
  3. If patching is not feasible, mitigate by disabling the release_agent feature: 
    echo "" > /sys/fs/cgroup/<cgroup>/release_agent
chmod 000 /sys/fs/cgroup/<cgroup>/release_agent
    Replace <cgroup> with the relevant hierarchy path.
  4. For container runtimes, enable the --disable-legacy-cgroup flag (Docker) or configure the runtime to use cgroups v2.
  5. Validate: After remediation, confirm that the release_agent file cannot be written by non‑root users: 
    ls -l /sys/fs/cgroup/*/release_agent

For ongoing visibility into exploitation trends, see the live indicator dashboard at https://vulnsocial.com/cve/CVE-2022-0492.

References

#CVE20220492 #LinuxKernel #PrivilegeEscalation #ContainerEscape #CISAKEV #HighSeverity #CVE