CVE-2022-0492

Confirmed PUBLISHED

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain...

Linux · kernel

1 hour faster than CISA KEV

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

7.8 High EPSS 5.5%

At a Glance

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

linux cisa

CVE Published: Mar 03, 2022
Exploitation Reported: Jun 02, 2026
CVSS: 7.8 High
EPSS: 5.5%

Low complexity No user interaction

Affected Versions

Vendor	Product	Version	Status
n/a	kernel	kernel 5.17 rc3	Affected

CVE References

DSA-5095 debian.org · Vendor Advisory https://www.debian.org/security/2022/dsa-5095
DSA-5096 debian.org · Vendor Advisory https://www.debian.org/security/2022/dsa-5096
[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update lists.debian.org · Mailing List https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html
[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update lists.debian.org · Mailing List https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
bugzilla.redhat.com/show_bug.cgi bugzilla.redhat.com · CVE Record https://bugzilla.redhat.com/show_bug.cgi?id=2051505

Show 5 more references

git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/... git.kernel.org · CVE Record https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/co...
packetstormsecurity.com/files/166444/Kernel-Live-Patch-Security-Noti... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/166444/Kernel-Live-Patch-Securit...
security.netapp.com/advisory/ntap-20220419-0002 security.netapp.com · CVE Record https://security.netapp.com/advisory/ntap-20220419-0002/
packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Noti... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Securit...
packetstormsecurity.com/files/176099/Docker-cgroups-Container-Escape... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/176099/Docker-cgroups-Container-...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
The Shadowserver First	2026-06-02 18:00 UTC
CISA	2026-06-02 18:00 UTC
All CISA Advisories	2026-06-02 19:21 UTC
CVE	2026-06-02 21:40 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_cgroup_escape.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 7.8 High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 6.9 Medium

AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitation Status

Exploited in the wild

Recorded 2026-06-02 18:00:36 UTC · CISA

Proof of concept available

Recorded 2022-03-11 08:02:46 UTC · GitHub

Weaknesses (CWE)

CWE-287

Improper Authentication

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_cgroup_escape.rb	Apr 28, 2025

Recent Mentions

CISA Adds Two Known Exploited Vulnerabilities to Catalog

All CISA Advisories · Jun 02, 2026

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2022-0492 Linux Kernel Improper Authentication Vulnerability CVE-2025-48595 Android Framework Integer Overflow Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

T1erno/CVE-2022-0492-Docker-Breakout-Checker-and-PoC

github · Created 2023-02-18 04:48:25 UTC · 5 stars

Docker Breakout Checker and PoC via CAP_SYS_ADMIN and via user namespaces (CVE-2022-0492)

yoeelingBin/CVE-2022-0492-Container-Escape

github · Created 2022-08-27 04:02:24 UTC · 2 stars

CVE-2022-0492-Container-Escape

Trinadh465/device_renesas_kernel_AOSP10_r33_CVE-2022-0492

github · Created 2022-05-09 13:20:03 UTC · 0 stars

chenaotian/CVE-2022-0492

github · Created 2022-03-11 08:02:46 UTC · 28 stars

CVE-2022-0492 EXP and Analysis write up

SofianeHamlaoui/CVE-2022-0492-Checker

github · Created 2022-03-06 10:57:09 UTC · 9 stars

A script to check if a container environment is vulnerable to container escapes via CVE-2022-0492

docker_cgroup_escape

metasploit · Created Unknown

Metasploit module for CVE-2022-0492

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

2 Jun 2026 21:40 UTC about 2 months ago

2 Jun 2026 21:40 UTC · about 2 months ago

KEV confirmed by CVE

Exploitation attested by an external source
2 Jun 2026 19:21 UTC about 2 months ago

2 Jun 2026 19:21 UTC · about 2 months ago

KEV confirmed by All CISA Advisories

Exploitation attested by an external source
2 Jun 2026 18:00 UTC about 2 months ago

2 Jun 2026 18:00 UTC · about 2 months ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
2 Jun 2026 18:00 UTC about 2 months ago

2 Jun 2026 18:00 UTC · about 2 months ago

Added to KEVIntel KEV Feed

High-confidence, third-party attested exploitation
28 Apr 2025 15:02 UTC about 1 year ago

28 Apr 2025 15:02 UTC · about 1 year ago

Metasploit module available

Exploit module available
6 Mar 2022 10:57 UTC over 4 years ago

6 Mar 2022 10:57 UTC · over 4 years ago

Public PoC available

Public proof-of-concept code published
3 Mar 2022 00:00 UTC over 4 years ago

3 Mar 2022 00:00 UTC · over 4 years ago

CVE published

Vulnerability disclosed publicly
4 Feb 2022 00:00 UTC over 4 years ago

4 Feb 2022 00:00 UTC · over 4 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2022-0492

{
  "cve_id": "CVE-2022-0492",
  "title": "A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in...",
  "affected_vendor": "Linux",
  "affected_product": "kernel",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 7.8,
  "epss_score": 0.05528,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2022-0492

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Recent Mentions

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API