Linux kernel cgroups vulnerability (CVE-2022-0492) — exploitable for privilege escalation and container escape

CVE-2022-0492 stems from a missing privilege check (CWE-287: improper authentication / CWE-862: missing authorization) in the "release_agent" feature of cgroups (control groups) v1, the Linux kernel resource-control mechanism. release_agent runs a specified program when a cgroup becomes empty, and the fact that this execution happens with high host-side privileges is what gets abused.

The impact is local privilege escalation, but what matters in practice is the possibility of "container escape." If a container is configured without sufficiently effective capability restrictions or seccomp/AppArmor protections, an attacker inside the container can use this vulnerability to execute arbitrary code at high privilege on the host, breaking container isolation and taking over the host.

Although disclosed in 2022, CISA added it to KEV on June 2, 2026. This shows that "even an old, known vulnerability is still being exploited in unpatched environments," underscoring the danger of neglected old kernels.

Key response: update to a fixed kernel provided by your distribution (most are already fixed). In addition, enforce the principle of least privilege in container runtimes — do not grant unnecessary capabilities (especially CAP_SYS_ADMIN), and enable seccomp/AppArmor/SELinux — to reduce escape risk through defense in depth. The federal civilian remediation deadline was June 5, 2026.