Linux kernel cgroups vulnerability (CVE-2022-0492) — exploitable for privilege escalation and container escape

1cgroups as a resource control mechanism

CVE-2022-0492 stems from a missing privilege check (CWE-287: improper authentication / CWE-862: missing authorization) in the "release_agent" feature of cgroups (control groups) v1, the Linux kernel resource-control mechanism. release_agent runs a specified program when a cgroup becomes empty, and the fact that this execution happens with high host-side privileges is what gets abused.

2The path to container escape

The impact is local privilege escalation, but what matters in practice is the possibility of "container escape." If a container is configured without sufficiently effective capability restrictions or seccomp/AppArmor protections, an attacker inside the container can use this vulnerability to execute arbitrary code at high privilege on the host, breaking container isolation and taking over the host.

3A 2022 flaw entering KEV in 2026

Although disclosed in 2022, CISA added it to KEV on June 2, 2026. This shows that "even an old, known vulnerability is still being exploited in unpatched environments," underscoring the danger of neglected old kernels.

4The path by which isolation breaks

The impact is local privilege escalation, but what matters in practice is the possibility of container escape. Following the steps shows where a countermeasure can be placed.

1. 1Gain a foothold inside the containerThe attacker reaches a state of being able to run code within it
2. 2Abuse release_agentThe mechanism run when a cgroup empties is set by exploiting the missing permission check
3. 3It runs with host privilegeThe specified program executes on the host at high privilege
4. 4Isolation breaksThe attacker leaves the container and can take the host

The path holds where a container does not adequately apply capability limits or protections such as seccomp and AppArmor. Put the other way, alongside updating to a fixed kernel, withholding unnecessary capabilities (CAP_SYS_ADMIN in particular) and enabling seccomp, AppArmor or SELinux are the means of stopping it at an intermediate step.