--- id: "CVE-2022-0492" kind: "vulnerability" aliases: ["CVE-2022-0492"] title: "A vulnerability was found in the Linux kernel\u2019s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function" severity: "high" cvss: 7.8 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "netapp h300s firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp h410c firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp h410s firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp h500s firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp h700s firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp bootstrap os", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["4.9.301"], "affected": ">= 2.6.24, < 4.9.301", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["4.14.266"], "affected": ">= 4.10, < 4.14.266", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["4.19.229"], "affected": ">= 4.15, < 4.19.229", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["5.4.177"], "affected": ">= 4.20, < 5.4.177", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["5.10.97"], "affected": ">= 5.5, < 5.10.97", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["5.15.20"], "affected": ">= 5.11, < 5.15.20", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["5.16.6"], "affected": ">= 5.16, < 5.16.6", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": [], "affected": "= 5.17", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 11.0", "ecosystem": "vendor"}, {"name": "redhat codeready linux builder", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat codeready linux builder", "fixed": [], "affected": "= 8.2", "ecosystem": "vendor"}, {"name": "redhat codeready linux builder for power little endian", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat codeready linux builder for power little endian", "fixed": [], "affected": "= 8.2", "ecosystem": "vendor"}, {"name": "redhat virtualization host", "fixed": [], "affected": "= 4.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux eus", "fixed": [], "affected": "= 8.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for ibm z systems", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for ibm z systems eus", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for power little endian", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for power little endian eus", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for real time for nfv tus", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for real time for nfv tus", "fixed": [], "affected": "= 8.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for real time tus", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for real time tus", "fixed": [], "affected": "= 8.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server aus", "fixed": [], "affected": "= 8.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server for power little endian update services for sap solutions", "fixed": [], "affected": "= 8.1", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server for power little endian update services for sap solutions", "fixed": [], "affected": "= 8.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server tus", "fixed": [], "affected": "= 8.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server update services for sap solutions", "fixed": [], "affected": "= 8.1", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server update services for sap solutions", "fixed": [], "affected": "= 8.2", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 14.04", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 16.04", "ecosystem": "vendor"}, {"name": "Linux Kernel", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["cloud", "containers", "exploited", "infrastructure", "kernel", "linux", "self-hosted"] not_affected_if: ["cgroups-v2-only", "no-untrusted-local-users"] published_at: "2022-03-03T19:15:08+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T00:09:50+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-0492", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0492", "first_seen_at": "2026-10-23T23:44:51+00:00"}] --- # A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function The Linux kernel does not properly check permissions when setting the cgroups v1 release_agent file, so a local user can register a program that the kernel runs with root privileges. An attacker who already has code execution on a machine can use it to escalate to root, and CISA lists it as actively exploited. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:netapp h300s firmware affected ? fixed ? - vendor:netapp h410c firmware affected ? fixed ? - vendor:netapp h410s firmware affected ? fixed ? - vendor:netapp h500s firmware affected ? fixed ? - vendor:netapp h700s firmware affected ? fixed ? - vendor:netapp bootstrap os affected ? fixed ? - vendor:linux kernel affected >= 2.6.24, < 4.9.301 fixed 4.9.301 - vendor:linux kernel affected >= 4.10, < 4.14.266 fixed 4.14.266 - vendor:linux kernel affected >= 4.15, < 4.19.229 fixed 4.19.229 - vendor:linux kernel affected >= 4.20, < 5.4.177 fixed 5.4.177 - vendor:linux kernel affected >= 5.5, < 5.10.97 fixed 5.10.97 - vendor:linux kernel affected >= 5.11, < 5.15.20 fixed 5.15.20 - vendor:linux kernel affected >= 5.16, < 5.16.6 fixed 5.16.6 - vendor:linux kernel affected = 5.17 fixed ? - vendor:debian linux affected = 9.0 fixed ? - vendor:debian linux affected = 10.0 fixed ? - vendor:debian linux affected = 11.0 fixed ? - vendor:redhat codeready linux builder affected = 8.0 fixed ? - vendor:redhat codeready linux builder affected = 8.2 fixed ? - vendor:redhat codeready linux builder for power little endian affected = 8.0 fixed ? - vendor:redhat codeready linux builder for power little endian affected = 8.2 fixed ? - vendor:redhat virtualization host affected = 4.0 fixed ? - vendor:redhat enterprise linux affected = 8.0 fixed ? - vendor:redhat enterprise linux eus affected = 8.2 fixed ? - vendor:redhat enterprise linux for ibm z systems affected = 8.0 fixed ? - vendor:redhat enterprise linux for ibm z systems eus affected = 8.0 fixed ? - vendor:redhat enterprise linux for power little endian affected = 8.0 fixed ? - vendor:redhat enterprise linux for power little endian eus affected = 8.0 fixed ? - vendor:redhat enterprise linux for real time for nfv tus affected = 8.0 fixed ? - vendor:redhat enterprise linux for real time for nfv tus affected = 8.2 fixed ? - vendor:redhat enterprise linux for real time tus affected = 8.0 fixed ? - vendor:redhat enterprise linux for real time tus affected = 8.2 fixed ? - vendor:redhat enterprise linux server aus affected = 8.2 fixed ? - vendor:redhat enterprise linux server for power little endian update services for sap solutions affected = 8.1 fixed ? - vendor:redhat enterprise linux server for power little endian update services for sap solutions affected = 8.2 fixed ? - vendor:redhat enterprise linux server tus affected = 8.2 fixed ? - vendor:redhat enterprise linux server update services for sap solutions affected = 8.1 fixed ? - vendor:redhat enterprise linux server update services for sap solutions affected = 8.2 fixed ? - vendor:canonical ubuntu linux affected = 14.04 fixed ? - vendor:canonical ubuntu linux affected = 16.04 fixed ? - vendor:Linux Kernel affected ? fixed ? ## Fix Apply the vendor's kernel update that fixes CVE-2022-0492, or follow the vendor mitigation guidance; the sources do not name a fixed kernel version. If no fix is available, the CISA notice says to discontinue use of the affected product. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-0492 - 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-0492 ## From the sources Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_