Is CVE-2022-0492 exploited in the wild?

Yes. CVE-2022-0492 is known to be exploited in the wild, first recorded on 2 June 2026. Treat it as urgent.

How severe is CVE-2022-0492?

Critical severity, with a CVSS score of 7.8, published 2 June 2026.

Which products and versions are affected?

Linux Linux Kernel 2.6.24 to 5.17-rc2.

Is there a fix for CVE-2022-0492?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2022-0492 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2022-0492?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-0492: Linux Kernel privilege escalation in cgroups v1 release_agent

CVE-2022-0492 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2026-06-02

A security vulnerability in the Linux Kernel could allow a user with limited access to gain full administrative control over a system. This issue specifically affects how the system manages 'containers' (isolated environments used to run applications), potentially allowing an attacker to break out of a restricted environment and access sensitive data or disrupt operations on the host machine. This vulnerability has been reported as being exploited in the wild.

Quick answers

Is CVE-2022-0492 exploited in the wild?: Yes. CVE-2022-0492 is known to be exploited in the wild, first recorded on 2 June 2026. Treat it as urgent.
How severe is CVE-2022-0492?: Critical severity, with a CVSS score of 7.8, published 2 June 2026.
Which products and versions are affected?: Linux Linux Kernel 2.6.24 to 5.17-rc2.
Is there a fix for CVE-2022-0492?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2022-0492 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2022-0492?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Linux kernel's cgroup_release_agent_write function within kernel/cgroup/cgroup-v1.c. The flaw stems from missing authorization checks when configuring the release_agent feature in cgroups v1. A local attacker with low privileges can exploit this to execute arbitrary code with root privileges or bypass namespace isolation to escape a container. The vulnerability is reachable if an attacker can mount a cgroupfs or modify the release_agent file. Patches have been released in the mainline kernel and various long-term support distributions.

Affected products

Linux Linux Kernel 2.6.24 to 5.17-rc2

Timeline

2022-03-07: advisory: Initial disclosure and Debian security advisories published
2022-04-19: advisory: NetApp advisory published
2026-06-02: disclosed: CISA-ADP enrichment and updated publication date

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.