Linux Kernel

CVE-2022-0492: Linux Kernel Improper Authentication Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2 Jun 2026, 1,552 days after the CVE record was published.

How likely is exploitation in the next 30 days?

5.5%

EPSS score, percentile 92.8 of all scored records

How severe?

7.8 High

CVSS v3.1 base score, from CISA's enrichment of the record

What should I do?

CISA deadline 5 Jun 2026. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Advisories and patches (2)

Which versions are affected?

Affected

kernel 5.17 rc3

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

Required action, set by CISA

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date for this action: 5 June 2026.

Advisories and patches

DSA-5095 (Vendor advisory)
DSA-5096 (Vendor advisory)

Linked from CISA's catalog entry

Affected products and versions

As listed in the CVE record.

n/a kernel
Status	Versions
Affected	kernel 5.17 rc3

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

CISA added CVE-2022-0492 to its Known Exploited Vulnerabilities (KEV) catalog on 2 Jun 2026.
CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
The due date CISA sets for the required action is 5 Jun 2026.
The CVE record was published on 3 Mar 2022, 1,552 days before it was added to KEV.
The CVE record carries a CVSS v3.1 base score of 7.8 (High), taken from CISA's enrichment of the record.
FIRST's EPSS model puts the probability of exploitation in the next 30 days at 5.5% (percentile 92.8), as of 28 Oct 2026.
CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Weakness

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

Date	Event
3 Mar 2022	CVE record published
2 Jun 2026	Added to CISA KEV
3 Jun 2026	CVE record last updated
5 Jun 2026	CISA due date for the required action

References

More exploited Linux vulnerabilities

CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability (added 28 Oct 2026)
CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability (added 18 Sep 2026)
CVE-2025-39964: Linux Kernel Race Condition Vulnerability (added 18 Sep 2026)
CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability (added 18 Sep 2026)
CVE-2026-53362: Linux Kernel Unspecified Vulnerability (added 27 Aug 2026)
CVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerability (added 26 Aug 2026)