U.S. CISA adds Android and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog

CVE-2022-0492 is a missing-authorization/improper-authentication flaw (CWE-862/CWE-287) in the Linux kernel's cgroups v1 support, in the cgroup_release_agent_write function of kernel/cgroup/cgroup-v1.c. Under certain conditions — notably when an attacker can wield CAP_SYS_ADMIN within a user namespace, as in some container or user-namespace configurations — they can write to a cgroup v1 controller's release_agent file and cause an arbitrary command to run outside the namespace. Successful exploitation yields privilege escalation on the host and an unexpected bypass of container/namespace isolation, i.e. a container escape, which is why it matters for containerized infrastructure. Affected products include the Linux kernel as shipped by Debian, Red Hat (Enterprise Linux, CodeReady Linux Builder, Red Hat Virtualization Host), Canonical and Fedora, plus NetApp HCI/HCI-adjacent firmware (H300S, H410C, H410S, H500S, H700S) and Bootstrap OS. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-02 (ransomware use unknown), and a public proof-of-concept Docker container escape is available, so defenders should treat exploitation as in the wild.

Do: Apply updated kernel packages from Debian, Red Hat, Canonical, or Fedora per vendor advisories, and NetApp firmware/Bootstrap OS updates per NetApp's security advisory; because the flaw is in CISA KEV, BOD 22-01 remediation timelines apply to federal agencies. If patching must wait, reduce exposure by disabling unprivileged user namespaces (e.g., user.max_user_namespaces=0 or kernel.unprivileged_userns_clone=0), preventing unprivileged write access to cgroups v1 release_agent files, and avoiding containers running with CAP_SYS_ADMIN. Audit container hosts and appliances for cgroups v1 mounts and user-namespace configurations, and monitor for exploitation given the public Docker-escape PoC and the KEV listing.

CVE-2025-48595 is an integer overflow (CWE-190) in the Android Framework, present in multiple locations, that can be triggered by code already running locally on the device with no additional execution privileges and no user interaction required. A local attacker, such as a malicious or compromised app, who triggers the overflow can achieve code execution with elevated privileges, yielding a local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.4, local attack vector). The flaw affects the Android Framework component of Google's Android operating system, so it applies broadly across the Android device ecosystem; specific affected version ranges were not published in the available data. Google fixed the flaw in its June 2026 Android security update, which patched 124 flaws overall, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-02, with news coverage confirming it is being actively exploited in the wild. No public proof-of-concept is known, but confirmed in-the-wild exploitation makes patching urgent.

Do: Apply Google's June 2026 Android security update (or later) to all Android devices as soon as the OEM build is available, and verify the device's 'Android security patch level' reads June 2026 or later before treating it as remediated. US federal agencies must remediate within the BOD 22-01 timelines per the KEV listing. Because exploitation requires local code execution, prioritize devices on which users can install or run untrusted apps, and use MDM tooling to track patch compliance across managed fleets.