Docker

CVE-2022-0492: Linux Kernel Cgroups v1 release_agent Container Escape Executive Summary CVE-2022-0492 is a privilege escalation vulnerability in the Linux kernel’s cgroup_release_agent_write function (kernel/cgroup/cgroup-v1.c). It allows a root process inside a container to escape to the host and gain full root privileges by abusing the cgroups v1 release_agent mechanism via user namespaces. Attribute Detail CVE CVE-2022-0492 CVSS 3.1 7.8 (HIGH) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE CWE-862 (Missing Authorization) / CWE-287 (Improper Authentication) Affected Linux kernel v2.6.24 through v5.16.6 Fixed Linux 5.17-rc3 (commit 24f6008564183) Type Container escape via cgroups v1 release_agent CISA KEV ✅ Added June 2, 2026 — actively exploited Public PoC ✅ Multiple (GitHub) Background: What is release_agent? cgroups v1 has a feature called release_agent — a path to a binary the kernel executes as root when a process in a child cgroup terminates (if notify_on_release is enabled). It lives in any cgroup v1 root directory: ...