KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2022-0492
7.8
3-Day Required
PoC Available
KEV
Active Exploitation
Details
VulnerabilityLinux Kernel Improper Authentication Vulnerability
VendorLinux
ProductKernel
Date added2026-06-02
Due date2026-06-05
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-287 CWE-862
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Descriptions
KEV: Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
NVD: A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
Compliance SSVC + BOD 26-04
Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required
Research metadata
Last researched2026-08-26 06:45 UTC
Wall time120.0s
Searches6
Component defaultyes
Sources
https://nvd.nist.gov/vuln/detail/CVE-2022-0492
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02af
https://github.com/bb33bb/CVE-2022-0492
https://github.com/T1erno/CVE-2022-0492-Docker-Breakout-Checker-and-PoC
https://github.com/chenaotian/CVE-2022-0492
https://github.com/SofianeHamlaoui/CVE-2022-0492-Checker
https://github.com/puckiestyle/CVE-2022-0492
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_cgroup_escape.rb
https://github.com/cdk-team/CDK/wiki/Exploit:-abuse-unpriv-userns
https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups/
https://www.openwall.com/lists/oss-security/2022/02/04/1
https://bugzilla.redhat.com/show_bug.cgi?id=2051505
https://security.netapp.com/advisory/ntap-20220419-0002/
https://www.sysdig.com/blog/detecting-mitigating-cve-2022-0492-sysdig
https://www.sentinelone.com/vulnerability-database/cve-2022-0492/
https://securityaffairs.com/128742/security/cve-2022-0492-linux-kernel-flaw.html
https://hacktricks.alquymia.com.br/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.html
https://terenceli.github.io/%E6%8A%80%E6%9C%AF/2022/03/06/cve-2022-0492
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02af
https://github.com/bb33bb/CVE-2022-0492
https://github.com/T1erno/CVE-2022-0492-Docker-Breakout-Checker-and-PoC
https://github.com/chenaotian/CVE-2022-0492
https://github.com/SofianeHamlaoui/CVE-2022-0492-Checker
https://github.com/puckiestyle/CVE-2022-0492
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_cgroup_escape.rb
https://github.com/cdk-team/CDK/wiki/Exploit:-abuse-unpriv-userns
https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups/
https://www.openwall.com/lists/oss-security/2022/02/04/1
https://bugzilla.redhat.com/show_bug.cgi?id=2051505
https://security.netapp.com/advisory/ntap-20220419-0002/
https://www.sysdig.com/blog/detecting-mitigating-cve-2022-0492-sysdig
https://www.sentinelone.com/vulnerability-database/cve-2022-0492/
https://securityaffairs.com/128742/security/cve-2022-0492-linux-kernel-flaw.html
https://hacktricks.alquymia.com.br/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.html
https://terenceli.github.io/%E6%8A%80%E6%9C%AF/2022/03/06/cve-2022-0492
Hunting hypothesis agent
Hunt audit logs for unshare() calls followed by 'mount -t cgroup', writing an overlay upperdir path into cgroup release_agent, setting notify_on_release=1, and triggering execution via cgroup.procs — the CVE-2022-0492 container escape.
Research details
ComponentLinux kernel cgroup v1 release_agent interface (function cgroup_release_agent_write in kernel/cgroup/cgroup-v1.c)
PreconditionsCVE-2022-0492 is a privilege escalation vulnerability in the Linux kernel's cgroups v1 release_agent feature. The root cause is a missing capabilities check in the cgroup_release_agent_write function (kernel/cgroup/cgroup-v1.c): the kernel failed to verify that the process setting the release_agent file has CAP_SYS_ADMIN in the initial user namespace. Affected kernel versions span from cgroups introduction (2.6.24) up to fixed versions: 5.16.6, 5.15.20, 5.10.97, 5.4.177, 4.19.229, 4.14.266, and 4.9.301. The vulnerability is exploitable in two scenarios: (1) User namespace escape (no CAP_SYS_ADMIN needed): the attacker must have root shell access inside a container, the host must have unprivileged user namespaces enabled (kernel.unprivileged_userns_clone=1, default on Ubuntu), the container must run without AppArmor/SELinux (which block cgroupfs mounting), and without Seccomp (which blocks the unshare() syscall). The attacker calls unshare() to create new user+cgroup namespaces, gaining CAP_SYS_ADMIN in the new namespace, mounts a cgroup filesystem (e.g., RDMA or memory controller), writes a malicious path to the release_agent file, enables notify_on_release on a child cgroup, uploads a payload, and triggers execution by writing the shell PID to cgroup.procs and exiting the shell — the kernel executes the payload as root on the host. (2) CAP_SYS_ADMIN escape: the container has CAP_SYS_ADMIN capability granted and runs without cgroup namespace isolation (default). The attacker mounts cgroupfs directly (no unshare needed), modifies release_agent, and triggers execution. The vulnerability was disclosed by Yiqi Sun and Kevin Wang of Huawei Security Team on February 4, 2022. The fix commit 24f6008564183 ('cgroup: require capabilities to set release_agent') requires CAP_SYS_ADMIN in the initial user namespace. Multiple public PoCs exist including GitHub repositories (bb33bb, T1erno, chenaotian, SofianeHamlaoui, puckiestyle), a Metasploit module (docker_cgroup_escape.rb), and the CDK tool (abuse-unpriv-userns). The vulnerability is trivial to exploit once prerequisites are met. Mitigations include upgrading the kernel, enabling AppArmor/SELinux, enabling Seccomp, and dropping CAP_SYS_ADMIN from containers. agent
DeliveryThe exploit is delivered locally through a malicious container or process that already has root-level shell access inside a container running on a vulnerable host. The attacker must be able to execute commands (as root) within the container. In typical attack chains, the initial compromise occurs via application-level vulnerabilities, exposed container management interfaces, or malicious container images. Once inside a container that lacks AppArmor/SELinux and Seccomp protections, the attacker can escalate to full host root access. The exploit can also be executed from a low-privileged host process if it has CAP_DAC_OVERRIDE capability to bypass file permission checks on release_agent.
Public PoCyes
PoC URLs
https://github.com/bb33bb/CVE-2022-0492
https://github.com/T1erno/CVE-2022-0492-Docker-Breakout-Checker-and-PoC
https://github.com/chenaotian/CVE-2022-0492
https://github.com/SofianeHamlaoui/CVE-2022-0492-Checker
https://github.com/puckiestyle/CVE-2022-0492
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_cgroup_escape.rb
https://github.com/cdk-team/CDK/wiki/Exploit:-abuse-unpriv-userns Third-party repos; verify before use.
https://github.com/T1erno/CVE-2022-0492-Docker-Breakout-Checker-and-PoC
https://github.com/chenaotian/CVE-2022-0492
https://github.com/SofianeHamlaoui/CVE-2022-0492-Checker
https://github.com/puckiestyle/CVE-2022-0492
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_cgroup_escape.rb
https://github.com/cdk-team/CDK/wiki/Exploit:-abuse-unpriv-userns Third-party repos; verify before use.
Exploit notesLow complexity (CVSS AC:L). The vulnerability is trivial to exploit once prerequisites are met (root inside container, no AppArmor/SELinux, no Seccomp, unprivileged user namespaces enabled). Multiple working PoCs and a Metasploit module are publicly available. The exploit requires root access inside the container but no additional privileges on the host. The most common barrier is AppArmor/SELinux and Seccomp which block the attack by preventing cgroupfs mounting or blocking unshare().
SummaryLinux kernel cgroup v1 release_agent interface missing capability check enables container escape and privilege escalation — multiple public PoCs confirmed, Metasploit module available, actively exploited in the wild.
Tia coverage
First reported2026-06-04
First exploit report2026-06-04
Exploit report → KEV2 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
cisa-adds-cve-2022-0492-to-kev-linux-kernel-cgroup-v1-container
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.