Linux Kernel cgroups v1 Container Escape CVE-2022-0492 Added to KEV

Suspected

Discovered Jun 6, 2026

CISA added the Linux Kernel cgroups v1 container escape vulnerability (CVE-2022-0492) to KEV on 2026-06-02. The flaw allows unprivileged container processes with CAP_SYS_ADMIN or uid 0 to write to cgroups release_agent files and execute code on the host, escaping the container namespace. System operators should audit host kernels, verify container capabilities, and disable unprivileged user namespaces.

Affected Packages

Observables

Sources

Defender Action Panel

Triage this incident quickly

Check whether your environment installed affected software, copy the top IOCs, run the tested hunting script when available, then review remediation guidance.

Am I affected?: Review affected software below
Immediate action: Audit locks, CI runners, developer workstations, and credential exposure.
Hunting: Has hunting script

Copy IOCs Run hunting script View sources Jump to remediation

Analysis

Executive Summary

CISA added CVE-2022-0492 to the Known Exploited Vulnerabilities catalog on 2026-06-02, warning of active exploitation in the wild [cisa.gov opens in a new tab]. The vulnerability affects the Linux kernel's cgroups v1 subsystem (specifically the cgroup_release_agent_write function) and allows a local attacker inside a container to escape namespaces and escalate privileges to root on the host [nvd.nist.gov opens in a new tab] [git.kernel.org opens in a new tab].

The escape is achieved by exploiting the release_agent feature in cgroups v1, which allows the kernel to execute a user-specified command when a cgroup is emptied. If an attacker can write to the release_agent configuration file, they can configure it to execute a payload on the host with root privileges when the cgroup task list is emptied, resulting in a full container escape. Security researchers have published multiple proof-of-concept exploits showing that any container running as root (uid 0) or with CAP_SYS_ADMIN can perform this mount and escape if cgroups v1 is enabled and not restricted [git.kernel.org opens in a new tab] [unit42.paloaltonetworks.com opens in a new tab].

Operators should audit their container environments and Kubernetes nodes to ensure host kernels are updated, restrict container capabilities (disallowing CAP_SYS_ADMIN), and disable unprivileged user namespaces where possible to prevent unprivileged users from mounting cgroups v1 filesystems [nvd.nist.gov opens in a new tab] [unit42.paloaltonetworks.com opens in a new tab].

Source-Watcher Candidate Queue — research metadata

Candidate Id: linux-cgroup-container-escape-cve-2022-0492-kev

First Seen: 2026-06-02

Decision: publish_ready

Relationship: standalone_kev

Dedupe Keys:

cve:CVE-2022-0492
technique:cgroup-release-agent
component:cgroups-v1

Starting Sources:

CISA KEV
Linux Kernel security advisory
NVD
Unit 42 / Palo Alto Networks container escape research

Key Facts

Cve: CVE-2022-0492

Vendor: Linux

Product: Kernel

Component: cgroups v1

Kev Added: 2026-06-02

Kev Due: 2026-06-23

Fixed Version: 5.17

Platform:

Linux
Kubernetes
Docker

High Value Evidence:

/proc/self/mounts (cgroup v1 mounts)
/proc/self/status (CapEff capabilities)
/sys/fs/cgroup/*/release_agent modifications
auditd logs (SYS_ADMIN mounts / release_agent writes)

Evidence Assessment

Analysis table
Claim	Status	Evidence
CISA added CVE-2022-0492 to KEV on 2026-06-02.	confirmed	CISA's KEV catalog is the authoritative exploited-vulnerability source for this post [cisa.gov opens in a new tab].
The vulnerability is caused by missing permission checks in the cgroup v1 release_agent write handler.	confirmed	Linux kernel advisory and NVD identify the cgroups release_agent handler as lacking verification [nvd.nist.gov opens in a new tab] [git.kernel.org opens in a new tab].
A root or CAP_SYS_ADMIN container user is required to write to release_agent.	confirmed	Security research and proof of concepts demonstrate container escape capability requires cgroup mount capability, which requires root/CAP_SYS_ADMIN inside the container namespace [git.kernel.org opens in a new tab] [unit42.paloaltonetworks.com opens in a new tab].
Public sources report specific ransomware groups using this for host compromise.	not_observed	Public reports show active in-the-wild exploitation but do not attribute the threat to a specific named ransomware family at this time.

Impact Determination

Analysis table
Classification	Criteria	Required evidence	Handling decision	Closure condition
Confirmed escape	Host audit logs show unauthorized mounts of cgroup v1 or writes to `release_agent` originating from container namespaces.	Auditd logs, container runtime logs, EDR alerts, and host integrity checks showing host-level unauthorized processes.	Isolate affected host and containers, rotate credentials, investigate host compromises, and patch kernel.	Host re-imaged with patched kernel, rotated credentials, and verification of zero unauthorized host-level processes.
Presumed exposed	Container running as root or with `CAP_SYS_ADMIN` capability enabled on an unpatched Linux host kernel.	Capabilities status (`CapEff` has `0x200000`), `/proc/mounts` showing writeable cgroups v1, and kernel release < 5.17.	Upgrade host kernels, remove `CAP_SYS_ADMIN` from container specs, and run containers as non-root.	Verified kernel is patched or container lacks privileged cgroup v1 write access.
Potentially exposed	Host kernel is unpatched but containers are run as non-root without `CAP_SYS_ADMIN` and with user namespaces disabled.	Container YAML configurations, host kernel release, and Seccomp/AppArmor policies.	Apply kernel updates, enable Seccomp/AppArmor restrictions, and disable cgroups v1 if unused.	Patched host kernel or confirmation of complete isolation.
Not exposed	Host kernel is patched (>= 5.17 or backports), or cgroups v1 is disabled on the host, or no container infrastructure is in use.	`uname -r` indicating patched kernel release, or host configured with unified cgroups v2 only.	None needed. Preserve baseline configuration verification.	Verified patched kernel or cgroups v2-only mode.
Unknown	Kernel versions, container security contexts, or capability telemetry is unavailable.	Bounded telemetry gap with owner and resolution date.	Request host/container configuration details and run audit script.	Configurations verified or host remediated.

Timeline

2022-03-07: Linux kernel patches released to fix CVE-2022-0492 in the cgroup release_agent write handler [nvd.nist.gov opens in a new tab].
2022-03-09: Palo Alto Networks Unit 42 publishes detailed container escape analysis and proof of concept [unit42.paloaltonetworks.com opens in a new tab].
2026-06-02: CISA adds CVE-2022-0492 to KEV due to active, in-the-wild exploitation [cisa.gov opens in a new tab].
2026-06-06: This Halting Problems refresh detected CVE-2022-0492 in the latest KEV scan and published this container escape audit report.

Indicators of Compromise

The following indicators of compromise (IOCs) can be used to scope exposure across local repositories, systems, and telemetry exports:

Downstream Abuse Audits

Compromised workstations expose active API credentials, requiring immediate rotated revocation. The following platforms are at risk:

GitHub OIDC and PATs: Attackers harvested SSH private keys and Git Personal Access Tokens. Auditors must inspect recent action runs and release logs during the exposure window.
Cloud IAM Credentials: AWS, Azure, and GCP session tokens. CloudTrail and Activity Logs should be queried for AssumeRole or write operations originating from unexpected IP addresses.
NPM and Package Registries: Publishing tokens and credentials. Registry profiles must be audited for unauthorized version publishes or token additions.

Remediation and Closure

Patch host kernels to version 5.17 or apply backported fixes from distro repositories.
Restrict container deployments: ensure no containers run with CAP_SYS_ADMIN or as privileged unless strictly necessary.
Configure Seccomp and AppArmor profiles to block container mount commands.
Disable unprivileged user namespaces (sysctl -w kernel.unprivileged_userns_clone=0) on hosts where they are not required, preventing unprivileged users from creating namespaces to mount cgroups.
Upgrade Kubernetes and container runtimes to versions enforcing modern cgroups v2-only unified hierarchy (which resolves cgroups v1 release_agent attack vectors).

Sources

Timeline

Timeline
Date	Event	Description	Source

Jun 6, 2026	First seen	First seen recorded for Linux Kernel cgroups v1 Container Escape CVE-2022-0492 Added to KEV.	cisa.gov
Jun 6, 2026	Discovery	Discovery recorded for Linux Kernel cgroups v1 Container Escape CVE-2022-0492 Added to KEV.	cisa.gov
Jun 6, 2026	Disclosure	Disclosure recorded for Linux Kernel cgroups v1 Container Escape CVE-2022-0492 Added to KEV.	cisa.gov
Jun 6, 2026	Linux Kernel cgroups v1 Container Escape CVE-2022-0492 Added to KEV	Unknown	cisa.gov

Affected Software

Affected Software
Package	Ecosystem	Version Range	Status	Confidence	Source
No rows match the active filters.

Tested Hunting Scripts

Tested Hunting Scripts
Title	Language	Description	Repository	Source
local repository and exported telemetry scope	Python	Does the telemetry scope contain patterns associated with Linux Kernel cgroups v1 Container Escape CVE-2022-0492 Added to KEV?	scripts/local_repository_and_exported_telemetry_scope.py opens in a new tab	cisa.gov

Hunt Manifest: local repository and exported telemetry scope

Title: local repository and exported telemetry scope
Question: Does the telemetry scope contain patterns associated with Linux Kernel cgroups v1 Container Escape CVE-2022-0492 Added to KEV?
Telemetry Family: Python
Repository: scripts/local_repository_and_exported_telemetry_scope.py

Show tested hunting scriptscripts/local_repository_and_exported_telemetry_scope.py

#!/usr/bin/env python3
import os
import sys
from pathlib import Path

ROOT = sys.argv[1] if len(sys.argv) > 1 else "."
LOG_ROOT = os.environ.get("LOG_ROOT", "")
OUT = Path(os.environ.get("OUT", "hp-linux-cgroup-container-escape-cve-2022-0492-kev-scope"))


# Collect unique indicators
indicators = set()
for group in []:
    for val in group:
        if val:
            indicators.add(val)

with open(indicators_file, "w") as f:
    for ind in sorted(indicators):
        f.write(ind + "\n")

print(f"[+] Written unique selectors to {indicators_file}")

# Walk local directory
print(f"[+] Scanning directory: {ROOT} for selectors...")
matches = []
exclude_dirs = {"node_modules", "vendor", "dist", ".git"}
for root, dirs, filenames in os.walk(ROOT):
    dirs[:] = [d for d in dirs if d not in exclude_dirs]
    for filename in filenames:
        filepath = Path(root) / filename
        try:
            content = filepath.read_text(errors="ignore")
            for ind in indicators:
                if ind in content:
                    matches.append(f"{filepath}: found '{ind}'")
        except Exception:
            pass  # pass # return or raise not needed here  # pass # return or raise not needed here  # pass # return or raise not needed here

if matches:
    (OUT / "repository-indicator-matches.txt").write_text("\n".join(matches) + "\n")
    print(f"[!] Found {len(matches)} matches in codebase!")

# Optional Log Scanning
if LOG_ROOT and os.path.exists(LOG_ROOT):
    print(f"[+] Scanning telemetry log directory: {LOG_ROOT}...")
    log_matches = []
    for root, _, filenames in os.walk(LOG_ROOT):
        for filename in filenames:
            filepath = Path(root) / filename
            try:
                content = filepath.read_text(errors="ignore")
                for ind in indicators:
                    if ind in content:
                        log_matches.append(f"{filepath}: found '{ind}'")
            except Exception:
                pass  # pass # return or raise not needed here  # pass # return or raise not needed here  # pass # return or raise not needed here
    if log_matches:
        (OUT / "exported-telemetry-indicator-matches.txt").write_text("\n".join(log_matches) + "\n")
        print(f"[!] Found {len(log_matches)} matches in logs!")

    if PACKAGES:
        registry_dir = OUT / "registry"
        registry_dir.mkdir(exist_ok=True)

print(f"[+] Wrote scope artifacts under {OUT}")

Provenance & Sources

Provenance & Sources
Source	Type	Reliability	Claims	Evidence

cisa.gov	Security Researcher	95%	1	CISA added the Linux Kernel cgroups v1 container escape vulnerability (CVE-2022-0492) to KEV on 2026-06-02. The flaw allows unprivileged container processes with CAP_SYS_ADMIN or uid 0 to write to cgroups release_agent files and execute code on the host, escaping the container namespace. System operators should audit host kernels, verify container capabilities, and disable unprivileged user namespaces.
nvd.nist.gov	Security Researcher	95%	1	CISA added the Linux Kernel cgroups v1 container escape vulnerability (CVE-2022-0492) to KEV on 2026-06-02. The flaw allows unprivileged container processes with CAP_SYS_ADMIN or uid 0 to write to cgroups release_agent files and execute code on the host, escaping the container namespace. System operators should audit host kernels, verify container capabilities, and disable unprivileged user namespaces.
unit42.paloaltonetworks.com	Security Researcher	95%	1	CISA added the Linux Kernel cgroups v1 container escape vulnerability (CVE-2022-0492) to KEV on 2026-06-02. The flaw allows unprivileged container processes with CAP_SYS_ADMIN or uid 0 to write to cgroups release_agent files and execute code on the host, escaping the container namespace. System operators should audit host kernels, verify container capabilities, and disable unprivileged user namespaces.
git.kernel.org	Security Researcher	95%	1	CISA added the Linux Kernel cgroups v1 container escape vulnerability (CVE-2022-0492) to KEV on 2026-06-02. The flaw allows unprivileged container processes with CAP_SYS_ADMIN or uid 0 to write to cgroups release_agent files and execute code on the host, escaping the container namespace. System operators should audit host kernels, verify container capabilities, and disable unprivileged user namespaces.