CVE-2022-0492: Linux kernel cgroups v1 release_agent privilege escalation

Exploited in the wild High 7.8 EPSS 5.5% Linux kernel

cgroup_release_agent_write() in kernel/cgroup/cgroup-v1.c did not require the needed capabilities before letting a process set the cgroups v1 release_agent program. Under certain circumstances, for example inside a container, a process can use this to escalate privileges and bypass namespace isolation (Red Hat); a Docker container-escape exploit is public. Fixed in Linux 5.17 and stable 4.9.301, 4.14.266, 4.19.229, 5.4.177, 5.10.97, 5.15.20 and 5.16.6. CISA added it to KEV on 2 June 2026.

• CVE-2022-0492CVE identifier
• 7.8CVSS 3.1 base score (high)
• 2026-06-02added to CISA's exploited list (US federal deadline 2026-06-05)
• 5.5%EPSS: chance of exploitation in the next 30 days (higher than 93% of CVEs)
• 2022-03-03published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• Linux 2.6.24 through 4.9.300
• Linux 4.10 through 4.14.265
• Linux 4.15 through 4.19.228
• Linux 4.20 through 5.4.176
• Linux 5.5 through 5.10.96
• Linux 5.11 through 5.15.19
• Linux 5.16 through 5.16.5

Fixed in:

• Linux 4.9.301
• Linux 4.14.266
• Linux 4.19.229
• Linux 5.4.177
• Linux 5.10.97
• Linux 5.15.20
• Linux 5.16.6
• Linux 5.17

Am I affected?

uname -r
dpkg -l 'linux-image*' | grep ^ii   # Debian/Ubuntu
rpm -q kernel   # RHEL/Fedora/Amazon/SUSE (SUSE: rpm -q kernel-default)

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update
sudo apt upgrade
sudo reboot

sudo apt update
sudo apt upgrade
sudo reboot
# Ubuntu 22.04 and later are not affected.

sudo dnf upgrade kernel
sudo reboot
# RHEL 7: sudo yum update kernel
# RHEL 9 is not affected (Red Hat).

sudo dnf upgrade --refresh kernel
sudo reboot

sudo zypper refresh
sudo zypper patch --category security
sudo reboot

# Amazon Linux 2023
sudo dnf upgrade --releasever=latest 'kernel*'
# Amazon Linux 2
sudo yum update kernel
sudo reboot

sudo pacman -Syu
sudo reboot

# as root
apk update
apk upgrade
reboot

not Linux

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

• Red Hat says no mitigation meets its criteria, but notes SELinux in enforcing mode blocks this escape on OpenShift nodes and Red Hat Virtualization hosts; keep SELinux enforcing.

Sources

• CVE record CVE-2022-0492
• NVD CVE-2022-0492
• CISA KEV entry CVE-2022-0492
• Debian security tracker CVE-2022-0492
• Ubuntu CVE page CVE-2022-0492
• Red Hat CVE page CVE-2022-0492
• SUSE CVE page CVE-2022-0492
• Amazon Linux ALAS CVE page CVE-2022-0492
• Upstream fix (cgroup-v1: Require capabilities to set release_agent)
• oss-security disclosure (2022-02-04)
• Debian DSA-5095-1
• Ubuntu Livepatch notice LSN-0085-1
• https://bugzilla.redhat.com/show_bug.cgi?id=2051505
• https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html
• https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
• https://www.debian.org/security/2022/dsa-5096
• https://security.netapp.com/advisory/ntap-20220419-0002/
• CISA Known Exploited Vulnerabilities catalog

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.