CVE-2022-0492

HIGH KEV

Docker cgroups Container Escape

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2022-0492 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added June 2, 2026. EIP tracks 10 public exploits from researchers including PaloAltoNetworks, chenaotian, SofianeHamlaoui, including a Metasploit module exploits/linux/local/docker_cgroup_escape.

AI-analyzed exploit summary This repository contains a scanner to test for container escape vulnerabilities via CVE-2022-0492, which involves exploiting cgroup release_agent mechanisms. It checks for CAP_SYS_ADMIN capabilities and user namespace abuses.

Description

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

Exploits (10)

nomisec SCANNER 48 stars
by PaloAltoNetworks · local
https://github.com/PaloAltoNetworks/can-ctr-escape-cve-2022-0492

This repository contains a scanner to test for container escape vulnerabilities via CVE-2022-0492, which involves exploiting cgroup release_agent mechanisms. It checks for CAP_SYS_ADMIN capabilities and user namespace abuses.

Classification
Scanner 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux containers (Docker/Kubernetes) with vulnerable cgroup configurations
No auth needed
Prerequisites: Container with CAP_SYS_ADMIN or user namespace access · Vulnerable cgroup configuration
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 33 stars
by chenaotian · local
https://github.com/chenaotian/CVE-2022-0492

This repository contains a working exploit PoC for CVE-2022-0492, a container escape vulnerability in the Linux kernel's cgroup subsystem. The exploit leverages the lack of permission checks on the release_agent file to escape from a container to the host system.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (up to 5.17-rc3)
No auth needed
Prerequisites: Root access inside the container · Unconfined seccomp and apparmor profiles · Access to unshare command
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 11 stars
by SofianeHamlaoui · local
https://github.com/SofianeHamlaoui/CVE-2022-0492-Checker

This repository contains a checker script to determine if a container environment is vulnerable to CVE-2022-0492, a privilege escalation vulnerability in the Linux kernel's cgroups v1 release_agent feature. The script tests for two escape methods: via CAP_SYS_ADMIN and via user namespaces.

Classification
Scanner 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (cgroups v1)
No auth needed
Prerequisites: Container environment with cgroups v1 · Either CAP_SYS_ADMIN capability or unprivileged user namespaces enabled · No AppArmor or SELinux protections
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 5 stars
by T1erno · local
https://github.com/T1erno/CVE-2022-0492-Docker-Breakout-Checker-and-PoC

This repository contains a functional PoC for CVE-2022-0492, a Linux kernel vulnerability in cgroup v1's release_agent feature, allowing container escape via privilege escalation. The script checks for exploitability and executes arbitrary commands on the host system.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (cgroup v1)
Auth required
Prerequisites: root access inside a Docker container · CAP_SYS_ADMIN capability or user namespaces enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 2 stars
by KianaBin · poc
https://github.com/KianaBin/CVE-2022-0492-Container-Escape

This repository contains a functional Go-based exploit for CVE-2022-0492, a container escape vulnerability in the Linux kernel's cgroups v1 implementation. The exploit leverages the rdma cgroup subsystem to execute arbitrary commands on the host system by manipulating the release_agent mechanism.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (cgroups v1, specifically rdma subsystem)
No auth needed
Prerequisites: Container with CAP_SYS_ADMIN or ability to use unshare · Access to cgroups v1 with rdma subsystem
devstral-2 · analyzed Jun 06, 2026 Full analysis →
nomisec WORKING POC 2 stars
by yoeelingBin · local
https://github.com/yoeelingBin/CVE-2022-0492-Container-Escape

This PoC exploits CVE-2022-0492, a container escape vulnerability in Docker's cgroup v1 implementation. It leverages CAP_SYS_ADMIN or unshare to mount a cgroup with rdma subsystem, enabling arbitrary command execution on the host via release_agent.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Docker (with cgroup v1 and rdma subsystem enabled)
No auth needed
Prerequisites: CAP_SYS_ADMIN capability or ability to use unshare · cgroup v1 with rdma subsystem enabled · Docker container with write access to /tmp
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB
by Perimora · poc
https://github.com/Perimora/cve_2022_0492

This repository is a Bash script template with colorized output formatting and utility functions, but it does not contain any actual exploit code for CVE-2022-0492. The README and scripts only demonstrate a shell script framework.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: N/A
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by Trinadh465 · poc
https://github.com/Trinadh465/device_renesas_kernel_AOSP10_r33_CVE-2022-0492

This repository contains documentation files related to the Linux kernel, specifically focusing on ABI stability, admin guides, and hardware-specific documentation. It does not include any exploit code or proof-of-concept for CVE-2022-0492.

Classification
Writeup 90%
Attack Type
N/a
Complexity
N/a
Reliability
N/a
Target: N/A
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER
by bb33bb · poc
https://github.com/bb33bb/CVE-2022-0492

This repository contains a scanner script to check if a container environment is vulnerable to CVE-2022-0492, a privilege escalation vulnerability in the Linux kernel's cgroups v1 release_agent feature. It tests for exploitable conditions via CAP_SYS_ADMIN or user namespaces.

Classification
Scanner 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (cgroups v1)
No auth needed
Prerequisites: Container with CAP_SYS_ADMIN or unprivileged user namespaces enabled · No AppArmor/SELinux enforcement · Access to mount cgroupfs
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by h00die, Yiqi Sun, Kevin Wang, T1erno · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_cgroup_escape.rb

This Metasploit module exploits CVE-2022-0492, a Linux kernel vulnerability in cgroups v1, allowing container escape from Docker with SYS_ADMIN or privileged access. It abuses the release_agent feature to execute arbitrary code as root on the host.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (specific versions, e.g., Ubuntu kernels before patches)
Auth required
Prerequisites: Root access inside a Docker container · Container with SYS_ADMIN capability or privileged flag · Vulnerable host kernel
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 7.8
EPSS 0.0549
EPSS Percentile 91.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2026-06-02
VulnCheck KEV 2026-06-01
ENISA EUVD EUVD-2022-15629
CWE
CWE-287 CWE-862
Status published
Products (49)
None/kernel kernel 5.17 rc3
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 20.04
canonical/ubuntu_linux 22.04
debian/debian_linux 9.0
debian/debian_linux 10.0
debian/debian_linux 11.0
fedoraproject/fedora 35
... and 39 more
Published Mar 03, 2022
KEV Added Jun 02, 2026
Tracked Since Feb 18, 2026