Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2022-0492 is a high-severity Improper Authentication (CWE-287) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A vulnerability exists in the Linux kernel's handling of the cgroups v1 release_agent feature, specifically in the cgroup_release_agent_write function within kernel/cgroup/cgroup-v1.c. Under certain conditions, this flaw permits an attacker to misuse the release_agent mechanism to perform privilege escalation and break out of namespace isolation boundaries.
The issue is exploitable by a local attacker with limited privileges, such as a process running inside a container or other restricted environment. Successful exploitation grants the ability to execute arbitrary code with elevated privileges on the host, achieving full control over confidentiality, integrity, and availability of the system.
Kernel developers addressed the flaw through commits that restrict release_agent writes, and distributions have issued updates along with live kernel patches. References also document public container-escape techniques leveraging the same vector. The associated EPSS score rose from lower values to a peak of 0.3372, indicating growing exploitation interest after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15629
Vulnerability Data
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
- CWE(s)
- KEV Date Added
- 02 June 2026
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Session content review can reveal authentication bypasses or failures in session establishment.
Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.
Identity providers centralize and enforce authentication mechanisms, reducing improper authentication.
Requires explicit authorization before any identifier can be assigned, preventing missing authorization.
Personnel screening, identity verification, and access-agreement requirements support reliable authentication and reduce authentication bypass opportunities.
Requiring explicit security roles and risk integration in the SDLC forces authentication mechanisms to be planned, documented, and validated instead of omitted or weakly implemented.
Decoy authentication surfaces detect bypass attempts and deflect real credential attacks through observable malicious interactions.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring formal authorization of every access request before rights are granted ensures that checks for required permissions are performed, preventing missing authorization checks from being introduced.
Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.
A.5.17 directly mandates generation of non-guessable unique secrets, secure transmission, immediate change of defaults/temporary creds, strong password enforcement, no-reuse, and compromise response, which stops most improper-authentication exploits at source; the bounded remainder is non-password authentication methods and sufficiency-of-proof cases (e.g. IA-2/IA-5 enhancements) left to other controls.
A.5.18's provisioning, review, revocation and activation steps (incl. owner approval, SoD, timely removal on role/termination change) directly stop exploitation of missing authorization checks by ensuring no actor receives or retains rights to resources they should not access; the bounded remainder is that it cannot stop missing-authorization defects inside the enforcement mechanism itself once rights have been granted (e.g. flawed code that ignores the rights table).
By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.
A.5.8 integrates risk assessment, requirements elicitation and governance into the project lifecycle so that authorization needs can be identified and specified; it does not itself perform or enforce authorization checks, so the missing-authorization weakness can still be present and exploitable.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.