{"id":"CVE-2022-0492","kind":"vulnerability","aliases":["CVE-2022-0492"],"related":[],"title":"A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function","description":"Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"The Linux kernel does not properly check permissions when setting the cgroups v1 release_agent file, so a local user can register a program that the kernel runs with root privileges. An attacker who already has code execution on a machine can use it to escalate to root, and CISA lists it as actively exploited.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2026-06-02T00:00:00+00:00","products":[{"name":"netapp h300s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h410c firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h410s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h500s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h700s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp bootstrap os","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"linux kernel","fixed":["4.9.301"],"affected":">= 2.6.24, < 4.9.301","ecosystem":"vendor"},{"name":"linux kernel","fixed":["4.14.266"],"affected":">= 4.10, < 4.14.266","ecosystem":"vendor"},{"name":"linux kernel","fixed":["4.19.229"],"affected":">= 4.15, < 4.19.229","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.4.177"],"affected":">= 4.20, < 5.4.177","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.10.97"],"affected":">= 5.5, < 5.10.97","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.15.20"],"affected":">= 5.11, < 5.15.20","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.16.6"],"affected":">= 5.16, < 5.16.6","ecosystem":"vendor"},{"name":"linux kernel","fixed":[],"affected":"= 5.17","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"redhat codeready linux builder","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat codeready linux builder","fixed":[],"affected":"= 8.2","ecosystem":"vendor"},{"name":"redhat codeready linux builder for power little endian","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat codeready linux builder for power little endian","fixed":[],"affected":"= 8.2","ecosystem":"vendor"},{"name":"redhat virtualization host","fixed":[],"affected":"= 4.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 8.2","ecosystem":"vendor"},{"name":"redhat enterprise linux for ibm z systems","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat enterprise linux for ibm z systems eus","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat enterprise linux for power little endian","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat enterprise linux for power little endian eus","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat enterprise linux for real time for nfv tus","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat enterprise linux for real time for nfv tus","fixed":[],"affected":"= 8.2","ecosystem":"vendor"},{"name":"redhat enterprise linux for real time tus","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat enterprise linux for real time tus","fixed":[],"affected":"= 8.2","ecosystem":"vendor"},{"name":"redhat enterprise linux server aus","fixed":[],"affected":"= 8.2","ecosystem":"vendor"},{"name":"redhat enterprise linux server for power little endian update services for sap solutions","fixed":[],"affected":"= 8.1","ecosystem":"vendor"},{"name":"redhat enterprise linux server for power little endian update services for sap solutions","fixed":[],"affected":"= 8.2","ecosystem":"vendor"},{"name":"redhat enterprise linux server tus","fixed":[],"affected":"= 8.2","ecosystem":"vendor"},{"name":"redhat enterprise linux server update services for sap solutions","fixed":[],"affected":"= 8.1","ecosystem":"vendor"},{"name":"redhat enterprise linux server update services for sap solutions","fixed":[],"affected":"= 8.2","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 14.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 16.04","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloud","containers","exploited","infrastructure","kernel","linux","self-hosted"],"not_affected_if":["cgroups-v2-only","no-untrusted-local-users"],"how_to_check":null,"fix":"Apply the vendor's kernel update that fixes CVE-2022-0492, or follow the vendor mitigation guidance; the sources do not name a fixed kernel version.\nIf no fix is available, the CISA notice says to discontinue use of the affected product.","status":"open","published_at":"2022-03-03T19:15:08+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:34:00+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:34:00Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor's kernel update that fixes CVE-2022-0492, or follow the vendor mitigation guidance; the sources do not name a fixed kernel version.\nIf no fix is available, the CISA notice says to discontinue use of the affected product.","summary":"The Linux kernel does not properly check permissions when setting the cgroups v1 release_agent file, so a local user can register a program that the kernel runs with root privileges. An attacker who already has code execution on a machine can use it to escalate to root, and CISA lists it as actively exploited.","category":"infrastructure","who_cares":["linux","kernel","self-hosted","containers","cloud"],"confidence":0.7,"analyst_note":"Find the fixed kernel versions per distro and confirm whether unprivileged user namespaces or container runtimes are required for exploitation, at the kernel advisory linked from NVD for CVE-2022-0492.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["cgroups-v2-only","no-untrusted-local-users"],"severity_if_unknown":"high"},"cost_usd":0.000394,"input_tokens":2052,"output_tokens":377,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':318C '-0492':20A,23A '-2022':19A,22A '22':317C 'action':308C 'activ':284B 'agent':12A,245B,304C 'allow':295C 'alreadi':265B 'appli':309C 'applic':315C 'attack':263B 'aus':164A 'authent':291C 'bod':316C 'bootstrap':40A 'builder':67A,71A,75A,83A 'canonical':214A,217A 'cgroup':10A,242B,301C 'check':237B 'cisa':280B,306C 'cloud':222B,321C 'code':267B 'codeready':65A,69A,73A,81A 'contain':223B,288C 'could':294C 'cve':18A,21A 'debian':58A,60A,62A 'discontinu':324C 'endian':79A,87A,119A,126A,172A,185A 'enterprise':92A,95A,99A,106A,114A,121A,129A,138A,147A,154A,161A,166A,179A,192A,197A,206A 'escal':276B,298C 'eus':97A,112A,127A 'execut':268B 'exploit':224B,285B 'featur':305C 'file':246B 'firmware':26A,29A,32A,35A,38A 'follow':314C 'for':76A,84A,101A,108A,116A,123A,131A,134A,140A,143A,149A,156A,169A,175A,182A,188A,202A,211A 'found':4A 'function':17A 'guidanc':319C 'h300s':25A 'h410c':28A 'h410s':31A 'h500s':34A 'h700s':37A 'host':90A,230B 'ibm':102A,109A 'improp':290C 'infrastructur':225B 'instruct':313C 'kernel':8A,43A,45A,47A,49A,51A,53A,55A,57A,221A,226B,233B,257B,287C 'kernel/cgroup/cgroup-v1.c':16A 'linux':7A,42A,44A,46A,48A,50A,52A,54A,56A,59A,61A,63A,66A,70A,74A,82A,93A,96A,100A,107A,115A,122A,130A,139A,148A,155A,162A,167A,180A,193A,198A,207A,216A,219A,220A,227B,232B,286C 'list':281B 'little':78A,86A,118A,125A,171A,184A 'local':249B 'machin':271B 'mitig':310C,330C 'netapp':24A,27A,30A,33A,36A,39A 'nfv':135A,144A 'os':41A 'per':311C 'permiss':238B 'power':77A,85A,117A,124A,170A,183A 'privileg':261B,297C 'product':328C 'program':254B 'proper':236B 'real':132A,141A,150A,157A 'redhat':64A,68A,72A,80A,88A,91A,94A,98A,105A,113A,120A,128A,137A,146A,153A,160A,165A,178A,191A,196A,205A 'regist':252B 'releas':11A,244B,303C 'requir':307C 'root':260B,278B 'run':258B 'sap':176A,189A,203A,212A 'self':229B 'self-host':228B 'server':163A,168A,181A,194A,199A,208A 'servic':322C 'services':174A,187A,201A,210A 'set':240B 'solutions':177A,190A,204A,213A 'systems':104A,111A 'time':133A,142A,151A,158A 'tus':136A,145A,152A,159A,195A 'ubuntu':215A,218A 'unavail':332C 'update':173A,186A,200A,209A 'use':273B,325C 'user':250B 'v1':243B,302C 'vendor':312C 'via':299C 'virtualization':89A 'vulner':2A,292C 'write':13A 'z':103A,110A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-03-03T19:15:08+00:00","kev":{"dateAdded":"2026-06-02","dueDate":"2026-06-05","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-0492","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-0492","severity":null,"published_at":"2026-06-02T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-0492","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0492","severity":null,"published_at":"2022-03-03T19:15:08+00:00","modified_at":"2026-06-17T04:20:42+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}