Live › vulnerability › CVE-2022-0492
Go to dashboardThe Linux kernel does not properly check permissions when setting the cgroups v1 release_agent file, so a local user can register a program that the kernel runs with root privileges. An attacker who already has code execution on a machine can use it to escalate to root, and CISA lists it as actively exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| netapp h300s firmware | vendor | – | – |
| netapp h410c firmware | vendor | – | – |
| netapp h410s firmware | vendor | – | – |
| netapp h500s firmware | vendor | – | – |
| netapp h700s firmware | vendor | – | – |
| netapp bootstrap os | vendor |
| – |
| – |
| linux kernel | vendor | >= 2.6.24, < 4.9.301 | 4.9.301 |
| linux kernel | vendor | >= 4.10, < 4.14.266 | 4.14.266 |
| linux kernel | vendor | >= 4.15, < 4.19.229 | 4.19.229 |
| linux kernel | vendor | >= 4.20, < 5.4.177 | 5.4.177 |
| linux kernel | vendor | >= 5.5, < 5.10.97 | 5.10.97 |
| linux kernel | vendor | >= 5.11, < 5.15.20 | 5.15.20 |
| linux kernel | vendor | >= 5.16, < 5.16.6 | 5.16.6 |
| linux kernel | vendor | = 5.17 | – |
| debian linux | vendor | = 9.0 | – |
| debian linux | vendor | = 10.0 | – |
| debian linux | vendor | = 11.0 | – |
| redhat codeready linux builder | vendor | = 8.0 | – |
| redhat codeready linux builder | vendor | = 8.2 | – |
| redhat codeready linux builder for power little endian | vendor | = 8.0 | – |
| redhat codeready linux builder for power little endian | vendor | = 8.2 | – |
| redhat virtualization host | vendor | = 4.0 | – |
| redhat enterprise linux | vendor | = 8.0 | – |
| redhat enterprise linux eus | vendor | = 8.2 | – |
| redhat enterprise linux for ibm z systems | vendor | = 8.0 | – |
| redhat enterprise linux for ibm z systems eus | vendor | = 8.0 | – |
| redhat enterprise linux for power little endian | vendor | = 8.0 | – |
| redhat enterprise linux for power little endian eus | vendor | = 8.0 | – |
| redhat enterprise linux for real time for nfv tus | vendor | = 8.0 | – |
| redhat enterprise linux for real time for nfv tus | vendor | = 8.2 | – |
| redhat enterprise linux for real time tus | vendor | = 8.0 | – |
| redhat enterprise linux for real time tus | vendor | = 8.2 | – |
| redhat enterprise linux server aus | vendor | = 8.2 | – |
| redhat enterprise linux server for power little endian update services for sap solutions | vendor | = 8.1 | – |
| redhat enterprise linux server for power little endian update services for sap solutions | vendor | = 8.2 | – |
| redhat enterprise linux server tus | vendor | = 8.2 | – |
| redhat enterprise linux server update services for sap solutions | vendor | = 8.1 | – |
| redhat enterprise linux server update services for sap solutions | vendor | = 8.2 | – |
| canonical ubuntu linux | vendor | = 14.04 | – |
| canonical ubuntu linux | vendor | = 16.04 | – |
| Linux Kernel | vendor | – | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2022-0492")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.