CISA Adds CVE-2022-0492 to KEV — Linux Kernel cgroup-v1 Container Escape Actively Exploited

CVE-2022-0492 is a privilege escalation flaw in cgroup_release_agent_write in kernel/cgroup/cgroup-v1.c, scored 7.8, and CISA added it to the Known Exploited Vulnerabilities catalog on June 4 with a June 5 remediation deadline for federal agencies. On cgroups v1 hierarchies, the release_agent file at the root of the hierarchy can be written so that the kernel executes it as root on the host whenever the cgroup becomes empty. An attacker with code execution inside a container plants a script on a host-visible path, triggers the cgroup notification path, and gains root on the host, bypassing namespace isolation exactly as the CVE description states. Kaspersky has documented the attacks against container environments but has not attributed actors or named victims. Cgroups v2 hierarchies are not affected.

The reason this outranks the other kernel bugs of the week is what exploitation costs the attacker: nothing. It requires no exposed service, no network path, and no second bug. Any foothold inside any container on a vulnerable cgroup v1 kernel converts directly into host root, which means the exposure boundary is not "which services face the internet" but "which nodes still run 2021-era kernels in v1 mode." That inverts the usual container threat model, where the host is the hard shell around the soft workload. From host root, the next stop is the orchestration layer: kubelet credentials, container runtime sockets, and cluster secrets all live on or behind that node, so one escaped container can end as cluster-wide compromise. A 2022 bug with public root cause analysis since Unit 42's March 3, 2022 writeup clearing the exploit bar in 2026 is the pattern KEV exists for: n-days keep paying because fleet kernels are the slowest thing in most estates to update.

Inventory comes before patching. Run uname -r on every node and check stat -fc %T on /sys/fs/cgroup to tell v1 hosts from v2, since v2 hosts are out of scope for this CVE and v1 hosts are the priority queue. Patch kernels against the vendor advisory series: Ubuntu fixed this starting with USN-5302-1 on February 22, 2022, followed by USN-5337-1 through USN-5377-1 across kernel flavors, and every other major distribution shipped equivalent updates in the same window. Where patching lags, migrate nodes to cgroups v2, which the vulnerability does not affect. For hunting, set an auditd watch on writes to any release_agent file under /sys/fs/cgroup and alert on subsequent process executions that trace back to the cgroup release path; with Kaspersky unattributed, no one will tell you if you were hit, so your own audit logs and host telemetry are the only victim-detection surface that exists.

Two developments would change this assessment. Attribution and victim detail from Kaspersky, or from a second lab, would reveal whether these are targeted intrusions against specific container operators or something broader, and that distinction sets the urgency for anyone not yet patched. Watch also for the shift from targeted container attacks to opportunistic internet-wide scanning of Docker and Kubernetes hosts; if that telemetry appears, every unpatched cgroup v1 host moves from background risk to immediate exposure, and the June 5 deadline stops being someone else's problem.