Skip to content
You can now search across every topic, entity and event.What's new
Cybersecurity: Threats and Defences
7JUN

Old Linux container bug back in the wild

3 min read
10:08UTC

CISA listed a four-year-old Linux cgroups container-escape flaw and an Android CVSS 8.4 privilege bug on 2 June, both with a 5 June deadline. The spread across container infrastructure and a mobile handset, not any single entry, is the signal.

← Back to The 2024 patch that is breaking nowJump to analysis ↓
TechnologyDeveloping
Key takeaway

A 2022 Linux container escape and a current Android privilege bug are under active attack, both due by 5 June.

CISA added two flaws to its Known Exploited Vulnerabilities (KEV) catalogue on 2 June 2026 with a tight 5 June deadline 1. The older one, CVE-2022-0492, is a four-year-old Linux cgroups bug, where cgroups are the kernel feature that fences off container resources; it lets a process break out of its container and reach root on the host underneath.

Alongside it sat CVE-2025-48595, a CVSS 8.4 integer-overflow elevation-of-privilege flaw across Android 14, 15 and 16, which lets an attacker already on the device climb to higher rights through a malicious app 2. A container runtime and a mobile handset in one listing capture the breadth of the problem: the Office bug CISA surfaced in April had sat dormant for 17 years before exploitation , the same dynamic by which a 2022 kernel flaw resurfaces now.

For a defender triaging this batch, the cgroups entry is the more dangerous of the two. Cloud and Kubernetes estates run thousands of containers on shared hosts, and an escape to root on the host collapses the isolation those workloads depend on. CISA gave it three days where the WebLogic flaw in the same week got 21, because an attacker breaking out of a container moves faster than a patched maintenance window allows. The fix assumed applied in 2022 is the one to confirm first.

Deep Analysis

In plain English

Containers are a technology that lets software applications run in isolated boxes on a shared server, similar to having separate apartments in one building. CVE-2022-0492 is a four-year-old flaw that lets a malicious application inside one of these containers break out and take control of the entire server, the equivalent of a tenant breaking into the building's boiler room. CVE-2025-48595 affects Android phones running versions 14, 15 and 16. A malicious app downloaded from outside the Play Store (or a compromised legitimate app) can use this flaw to gain administrator-level control of the phone, giving it access to calls, messages, camera and location data without the owner's knowledge. Both flaws were added to CISA's urgent-action list on 2 June with a 5 June deadline.

Deep Analysis
Root Causes

Linux cgroups v1 exposes the release_agent mechanism for legitimate resource-cleanup purposes when containers exit. The kernel does not validate whether the process writing to release_agent has sufficient privilege relative to the host namespace; it relies on the container runtime (Docker, containerd) and the orchestrator (Kubernetes) to apply controls at a higher layer. When those higher-layer controls are absent or misconfigured, the cgroups subsystem itself provides no defence.

On Android, the integer-overflow class of vulnerability in CVE-2025-48595 affects the Android Framework layer, the Java-based abstraction above the Linux kernel that manages application permissions and inter-process communication.

Integer overflows in permission-boundary calculations enable an application to claim capabilities not granted at install time, bypassing both Google Play Protect attestation and Android's mandatory access control (SELinux) where the overflow corrupts a capability index rather than directly overwriting a protected region.

What could happen next?
  • Risk

    Docker and containerd environments without Pod Security Admission enforcement or Falco runtime monitoring remain exposed to the CVE-2022-0492 container-escape, which provides a direct root-on-host path for any attacker with code execution inside a container.

    Immediate · Assessed
  • Risk

    Android Enterprise Recommended fleet operators face a patch-compliance window measured in days for CVE-2025-48595, as KEV-listed Android EoP flaws may trigger mobile device management (MDM) quarantine policies that lock out unpatched devices.

    Immediate · Assessed
  • Consequence

    The pairing of a Linux kernel flaw with an Android framework flaw in a single 5 June deadline batch reflects CISA's move toward OS-agnostic KEV batching, which compresses the patch-resource contention for enterprise security teams managing both server and mobile fleets simultaneously.

    Short term · Suggested
Sources:CISA·BleepingComputer
Mentions:CVE-2022-0492 →CVE-2025-48595 →CISA →CVE-2023-50224 →CVE-2026-48172 →Drupal →Known Exploited Vulnerabilities →Azure →Google →China →Android →Linux cgroups →
First Reported In

Update #6 · The 2024 patch that is breaking now

CISA· 7 Jun 2026
Read original →
Different Perspectives
UK managed service providers and data centre operators
UK managed service providers and data centre operators
Newly brought into critical-infrastructure scope by the Cyber Security and Resilience Bill's Lords second reading, facing fines up to £17m or 4% of global turnover and a new near-miss reporting duty they did not previously carry. The sector moves from best-practice guidance to statutory exposure within this Parliamentary session.
Threat-intelligence industry
Threat-intelligence industry
SOCRadar's confirmation that one operator sits on two ransomware crews' negotiation panels, following Bitdefender's affiliate-overlap flag six weeks earlier, gives the sector its second independent data point that brand-based tracking undercounts shared access. The firms doing this work are shifting language from named-group attribution toward access-broker mapping.
FSB Centre 16
FSB Centre 16
Named by NCSC as running an SNMP-hijacking campaign against communications, energy, healthcare, defence and financial-services operators, harvesting device data and reconfiguring routers through a decades-old plaintext-authentication protocol. The campaign runs in parallel to, not in place of, the GRU's separate DNS-hijacking operation named in April.
CISA
CISA
CISA's Known Exploited Vulnerabilities catalogue added seven CVEs between 5 and 14 July, none from a headline security vendor, capped by the 18-year-old Cisco IOS bug CVE-2008-4128. BOD 26-04's risk-tiered listing rules make that slowdown as much a policy artefact as a threat-intensity read.
Nidec
Nidec
Nidec faces a $2m demand from Blackfield after the crew breached a server at its supplier Chaun Choung Technology rather than Nidec's own network. The attack reached Nidec's data without touching its own perimeter at all, the same supply-chain route World Leaks used against Tata Electronics.
Tata Electronics
Tata Electronics
Tata Electronics restricted remote access to its purchase-order systems and hired a forensic consultant after World Leaks posted 630GB of its files, including purported Apple and Tesla design material, to a leak site. The exposed value sits on its customers' balance sheets, not its own, which is what makes it hard to price.