CISA adds Linux kernel and Android flaws to exploited catalog
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA confirms two vulnerabilities actively exploited in the wild: a Linux kernel authentication flaw and Android integer overflow.
CISA has added CVE-2022-0492 and CVE-2025-48595 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming both are subject to active exploitation. CVE-2022-0492 is an improper authentication vulnerability in the Linux kernel; CVE-2025-48595 is an integer overflow flaw in the Android Framework. Both represent significant risk to federal systems and are frequently used as attack vectors by malicious actors.
Under Binding Operational Directive 22-01, federal civilian agencies must remediate these vulnerabilities by the published due dates. CISA urges all organizations—federal and non-federal alike—to prioritize patching these flaws as part of their vulnerability management practice. The KEV Catalog serves as a living list of CVEs confirmed to be actively exploited in the wild, making inclusion in the catalog a clear signal of remediation urgency.
Defenders should immediately identify systems running vulnerable Linux kernel versions and Android devices affected by the integer overflow, assess exposure in their environment, and apply available patches or mitigations without delay. The presence of these vulnerabilities on the KEV Catalog indicates attackers are actively targeting them.
Mentioned in this report
Detection guidance
Cgroup release_agent Manipulation Indicative of Container Escape (CVE-2022-0492 Pattern)
Detects command lines that write to or reference the cgroup v1 release_agent file, or unshare invocations that combine a user namespace with root mapping and a cgroup namespace. This is the public exploitation pattern for CVE-2022-0492. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cgroup release_agent Manipulation Indicative of Container Escape (CVE-2022-0492
Pattern)
description: Detects command lines that write to or reference the cgroup v1 release_agent
file, or unshare invocations combining a user namespace with root mapping and a
cgroup namespace. This is the public exploitation pattern for CVE-2022-0492 (Linux
kernel cgroups improper authentication). The CISA report gives no behavioural detail,
so this rule is based on the publicly known exploit mechanics.
tags:
- attack.privilege-escalation
- attack.t1611
logsource:
category: process_creation
product: linux
detection:
selection_release_agent:
CommandLine|contains: release_agent
selection_unshare:
Image|endswith: /unshare
CommandLine|contains:
- -UrmC
- -CUrm
- -rmUC
filter_container_tooling:
ParentImage|endswith:
- /runc
- /containerd-shim
- /dockerd
condition: 1 of selection_* and not filter_container_tooling
falsepositives:
- Security assessment or container-escape testing tools run by authorised red teams
- Administrators inspecting cgroup v1 settings by reading release_agent files manually
level: medium
id: bab3e529-b279-5a44-a6c3-232580357dac
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/06/02/cisa-adds-two-known-exploited-vulnerabilities-catalog
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/alerts/2026/06/02/cisa-adds-two-known-exploited-vulnerabilities-catalog
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs