Skip to content
You can now search across every topic, entity and event.What's new
Cybersecurity: Threats and Defences
7JUN

Old Linux container bug back in the wild

3 min read
10:08UTC

CISA listed a four-year-old Linux cgroups container-escape flaw and an Android CVSS 8.4 privilege bug on 2 June, both with a 5 June deadline. The spread across container infrastructure and a mobile handset, not any single entry, is the signal.

← Back to The 2024 patch that is breaking nowJump to analysis ↓
TechnologyDeveloping
Key takeaway

A 2022 Linux container escape and a current Android privilege bug are under active attack, both due by 5 June.

CISA added two flaws to its Known Exploited Vulnerabilities (KEV) catalogue on 2 June 2026 with a tight 5 June deadline 1. The older one, CVE-2022-0492, is a four-year-old Linux cgroups bug, where cgroups are the kernel feature that fences off container resources; it lets a process break out of its container and reach root on the host underneath.

Alongside it sat CVE-2025-48595, a CVSS 8.4 integer-overflow elevation-of-privilege flaw across Android 14, 15 and 16, which lets an attacker already on the device climb to higher rights through a malicious app 2. A container runtime and a mobile handset in one listing capture the breadth of the problem: the Office bug CISA surfaced in April had sat dormant for 17 years before exploitation , the same dynamic by which a 2022 kernel flaw resurfaces now.

For a defender triaging this batch, the cgroups entry is the more dangerous of the two. Cloud and Kubernetes estates run thousands of containers on shared hosts, and an escape to root on the host collapses the isolation those workloads depend on. CISA gave it three days where the WebLogic flaw in the same week got 21, because an attacker breaking out of a container moves faster than a patched maintenance window allows. The fix assumed applied in 2022 is the one to confirm first.

Deep Analysis

In plain English

Containers are a technology that lets software applications run in isolated boxes on a shared server, similar to having separate apartments in one building. CVE-2022-0492 is a four-year-old flaw that lets a malicious application inside one of these containers break out and take control of the entire server, the equivalent of a tenant breaking into the building's boiler room. CVE-2025-48595 affects Android phones running versions 14, 15 and 16. A malicious app downloaded from outside the Play Store (or a compromised legitimate app) can use this flaw to gain administrator-level control of the phone, giving it access to calls, messages, camera and location data without the owner's knowledge. Both flaws were added to CISA's urgent-action list on 2 June with a 5 June deadline.

Deep Analysis
Root Causes

Linux cgroups v1 exposes the release_agent mechanism for legitimate resource-cleanup purposes when containers exit. The kernel does not validate whether the process writing to release_agent has sufficient privilege relative to the host namespace; it relies on the container runtime (Docker, containerd) and the orchestrator (Kubernetes) to apply controls at a higher layer. When those higher-layer controls are absent or misconfigured, the cgroups subsystem itself provides no defence.

On Android, the integer-overflow class of vulnerability in CVE-2025-48595 affects the Android Framework layer, the Java-based abstraction above the Linux kernel that manages application permissions and inter-process communication.

Integer overflows in permission-boundary calculations enable an application to claim capabilities not granted at install time, bypassing both Google Play Protect attestation and Android's mandatory access control (SELinux) where the overflow corrupts a capability index rather than directly overwriting a protected region.

What could happen next?
  • Risk

    Docker and containerd environments without Pod Security Admission enforcement or Falco runtime monitoring remain exposed to the CVE-2022-0492 container-escape, which provides a direct root-on-host path for any attacker with code execution inside a container.

    Immediate · Assessed
  • Risk

    Android Enterprise Recommended fleet operators face a patch-compliance window measured in days for CVE-2025-48595, as KEV-listed Android EoP flaws may trigger mobile device management (MDM) quarantine policies that lock out unpatched devices.

    Immediate · Assessed
  • Consequence

    The pairing of a Linux kernel flaw with an Android framework flaw in a single 5 June deadline batch reflects CISA's move toward OS-agnostic KEV batching, which compresses the patch-resource contention for enterprise security teams managing both server and mobile fleets simultaneously.

    Short term · Suggested
Sources:CISA·BleepingComputer
Mentions:CVE-2022-0492 →CVE-2025-48595 →CISA →CVE-2023-50224 →CVE-2026-48172 →Drupal →Known Exploited Vulnerabilities →Azure →Google →China →Android →Linux cgroups →
First Reported In

Update #6 · The 2024 patch that is breaking now

CISA· 7 Jun 2026
Read original →
Different Perspectives
Group-IB
Group-IB
Group-IB, headquartered in Singapore, documented on 19 March that The Gentlemen began inside Qilin's own affiliate programme and split from it over a payment dispute. Its analysis makes this window's leak-site tally readable as a fracture inside one ransomware operation rather than the arrival of an unknown crew.
ENISA
ENISA
ENISA placed EU drinking water and wastewater in its cyber risk zone for the first time on 28 May, finding one in three water entities had never run a risk assessment. CISA's 30 July advisory to American operators reads as the operational sequel to a gap European regulators had already documented two months earlier.
House of Lords and NCSC
House of Lords and NCSC
The Cyber Security and Resilience Bill sits at House of Lords committee stage, its amendment paper running to 23 July. Separately, the NCSC guidance CISA cited when directing water operators to disconnect controllers is version 1.0 from March 2024, a two-year-old British document doing operational work in an American alert published last week.
heise online
heise online
heise online reported on 27 July that Russian state attackers, named as APT28, ran the hotel WiFi credential-harvesting campaign. Its attribution is firmer than ReliaQuest's own hedged low-to-medium confidence assessment of the same intrusion, a difference in national reporting posture rather than a settled dispute over who is responsible.
CISA and ReliaQuest
CISA and ReliaQuest
CISA compressed remediation deadlines under BOD 26-04 while, in the same window, telling water and wastewater operators to disconnect internet-exposed controllers rather than patch them. ReliaQuest, investigating the hotel WiFi campaign, held its assessment of the intrusion route at low-to-medium confidence and declined to name a state sponsor.
AIVD
AIVD
AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.