Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2022-0492

HighExploitedPublic exploit

This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

Published Jun 20, 2022 · Updated Oct 14, 2026 · Also known as A-224859358, DEBIAN-CVE-2022-0492, LSN-0085-1, PUB-A-224859358, SUSE-SU-2022:0991-1, SUSE-SU-2022:0998-1, SUSE-SU-2022:1036-1, UBUNTU-CVE-2022-0492, UBUNTU-CVE-2022-25636

Key Facts

Patch immediately
  • CVE-2022-0492 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Solidfire\, Enterprise Sds \& Hci Storage Node (Netapp), Solidfire \& Hci Management Node (Netapp), Codeready Linux Builder (Redhat) and 22 more products.
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jun 1, 2026. Public exploit code is available.
  • EPSS estimates a 5.5% probability of exploitation in the next 30 days.
  • Fixed versions are available, including :linux_kernel: :2022-06-05, bpftool 3.10.0-1160.66.1.el7, bpftool 4.18.0-348.20.1.el8_5.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

5.5%

Higher than 92.7% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2022-0492 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVJun 2, 2026Jun 5, 2026Not reported
Industry KEV feedJun 1, 2026Jun 5, 2026Not reported
CIRCL KEVJun 2, 2026Jun 5, 2026Not reported
ENISA EUVDJun 2, 2026n/aNot reported

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Products

1,250 affected entries in total
ProductAffected versionsFixed in
Solidfire\, Enterprise Sds \& Hci Storage NodeNetappSee advisoryn/a
Solidfire \& Hci Management NodeNetappSee advisoryn/a
Codeready Linux BuilderRedhat8.0, 8.2n/a
Codeready Linux Builder For Power Little EndianRedhat8.0, 8.2n/a
Virtualization HostRedhat4.0n/a
20 more affected products in the full CVE brief

Patched Releases

:linux_kernel:

:2022-06-05

bpftool

3.10.0-1160.66.1.el7, 4.18.0-348.20.1.el8_5, 5.10.93-4.ph4, 5.10.96-90.460.amzn2022, 5.15.73-45.135.amzn2022, 6.1.10-15.42.amzn2023

cluster-md-kmp-64kb

5.3.18-150300.59.54.1

cluster-md-kmp-azure

5.3.18-150300.38.47.1

cluster-md-kmp-default

4.12.14-122.113.1, 4.12.14-150.86.1, 4.12.14-197.108.1, 4.12.14-95.93.1, 4.4.180-94.156.1, 5.3.18-150300.59.54.1, 5.3.18-24.107.1

cluster-md-kmp-preempt

5.3.18-150300.59.54.1

cluster-md-kmp-rt

4.12.14-10.81.1, 5.3.18-150200.79.2, 5.3.18-150300.82.1

dlm-kmp-64kb

5.3.18-150300.59.54.1

dlm-kmp-azure

5.3.18-150300.38.47.1

dlm-kmp-default

4.12.14-122.113.1, 4.12.14-150.86.1, 4.12.14-197.108.1, 4.12.14-95.93.1, 4.4.180-94.156.1, 5.3.18-150300.59.54.1, 5.3.18-24.107.1

dlm-kmp-preempt

5.3.18-150300.59.54.1

dlm-kmp-rt

4.12.14-10.81.1, 5.3.18-150200.79.2, 5.3.18-150300.82.1

dtb-al

5.3.18-150300.59.54.1

dtb-allwinner

5.3.18-150300.59.54.1

dtb-altera

5.3.18-150300.59.54.1

dtb-amd

5.3.18-150300.59.54.1

dtb-amlogic

5.3.18-150300.59.54.1

dtb-apm

5.3.18-150300.59.54.1

dtb-arm

5.3.18-150300.59.54.1

dtb-broadcom

5.3.18-150300.59.54.1

dtb-cavium

5.3.18-150300.59.54.1

dtb-exynos

5.3.18-150300.59.54.1

dtb-freescale

5.3.18-150300.59.54.1

dtb-hisilicon

5.3.18-150300.59.54.1

dtb-lg

5.3.18-150300.59.54.1

Timeline

  1. Publicly disclosed

    Jun 20, 2022

  2. Added to Industry KEV feed

    Jun 1, 2026

  3. Added to CISA KEV

    Jun 2, 2026

  4. Added to CIRCL KEV

    Jun 2, 2026

  5. Added to ENISA EUVD

    Jun 2, 2026

  6. Last updated

    Oct 14, 2026

Weakness Type

  • CWE-287 Improper Authentication
  • CWE-862 Missing Authorization

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2022-0492 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo