CVE-2022-0492

CVE-2022-0492 is a missing-authorization/improper-authentication flaw (CWE-862/CWE-287) in the Linux kernel's cgroups v1 support, in the cgroup_release_agent_write function of kernel/cgroup/cgroup-v1.c. Under certain conditions — notably when an attacker can wield CAP_SYS_ADMIN within a user namespace, as in some container or user-namespace configurations — they can write to a cgroup v1 controller's release_agent file and cause an arbitrary command to run outside the namespace. Successful exploitation yields privilege escalation on the host and an unexpected bypass of container/namespace isolation, i.e. a container escape, which is why it matters for containerized infrastructure. Affected products include the Linux kernel as shipped by Debian, Red Hat (Enterprise Linux, CodeReady Linux Builder, Red Hat Virtualization Host), Canonical and Fedora, plus NetApp HCI/HCI-adjacent firmware (H300S, H410C, H410S, H500S, H700S) and Bootstrap OS. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-02 (ransomware use unknown), and a public proof-of-concept Docker container escape is available, so defenders should treat exploitation as in the wild.

What to do: Apply updated kernel packages from Debian, Red Hat, Canonical, or Fedora per vendor advisories, and NetApp firmware/Bootstrap OS updates per NetApp's security advisory; because the flaw is in CISA KEV, BOD 22-01 remediation timelines apply to federal agencies. If patching must wait, reduce exposure by disabling unprivileged user namespaces (e.g., user.max_user_namespaces=0 or kernel.unprivileged_userns_clone=0), preventing unprivileged write access to cgroups v1 release_agent files, and avoiding containers running with CAP_SYS_ADMIN. Audit container hosts and appliances for cgroups v1 mounts and user-namespace configurations, and monitor for exploitation given the public Docker-escape PoC and the KEV listing.