CISA KEV alert critical vulnerabilities on Android and Linux that allow you to climb privileges and container escapes

CISA has included in its catalogue of Known and Exploited Vulnerabilities (KEV) two failures that risk both Android devices and Linux-based infrastructure: an entire overflow in the Android framework that allows for the escalation of privileges without user interaction (CVE-2025-48595) and a failure in the Linux kernel's cgroups v1 subsystem that facilitates container escape and root in the host (CVE-2022-0492). The inclusion in KEV activates operational obligations for federal agencies and functions as a sign of urgency for companies and operators of critical infrastructure. More information about the CISA catalogue is available on the official website of the agency.

The Android failure, reported by Google, affects versions 14 to 16 of the operating system and can be exploited without the victim doing anything, which classifies it as a zero-click vector. Fails that do not require interaction significantly increase risk in mobile environments, because they allow for discreet and persistent commitments. Google incorporated the correction in the June 2026 patches; organizations and users must verify and apply these patches through their OEM channels or through MDM / EMM policies in corporate environments. Check the Android security newsletter to confirm the manufacturer's parking levels and indications: https: / / source.android.com / security / bulletin.

The other defect, CVE-2022-0492, affects multiple branches of the kernel (from 2.6 versions to 5.x series indicated by the maintainers) and lies in the cgroup _ release _ agent _ write () function of cgroups v1. Public investigations have shown how a malicious local execution can exploit the lack of authentication checks to get out of a container and get root privileges in the host, especially when containers have high capabilities. In cloud and Kubernete clusters this is a critical risk: a compromised container can become a door to the rest of the cluster and to host machines. Additional technical analysis can be found in security publications such as Aqua Security and Unit42 from Palo Alto Networks: Aqua Security and Unit42 (Palo Alto Networks), and the public entry of the NVD for the CVE is in https: / / nvd.nist.gov / vuln / detail / cve-2022-0492.

What should organizations do right now? The first and most important action is to park: apply security levels published by suppliers (Android patches for devices and kernel versions corrected for hosts). If the patch cannot be applied immediately, reduce the attack surface: avoid running containers with unnecessary capabilities, do not use privileged containers, transpose critical loads to isolated nodes, and consider moving loads to environments that implement cgroups v2 where possible. At the operational level, it activates mitigation controls such as restrictive seccomp profiles, capacity limitation (capacity reduction), and network policies that segmentate critical services.

It is also essential to implement detections: monitor process creation anomalies, namespace changes, unusual scriptures to release _ agent or unusual access to / proc and / sys, and alert on local privilege steps. Implement EDR and kernel-level records where feasible, and verify image integrity and orchestrator settings. If you detect suspicious activity, isolate the affected bodies and perform a forensic rescue before reintegrating them.

From the point of view of governance and continuity, keep an updated inventory of assets (corporate Android devices, kernel versions in hosts and nodes), prioritize according to exposure and criticality, and test patches in staging environments to minimize regression risks. Remember that CISA set a time frame for remediation in its catalogue; for entities under the BOD 22-01 directive this is not optional. The exposure window can be short: apply patches, mitigate and monitor urgently reduces the likelihood of successful intrusions.

Although CISA has not marked these entries as exploited by Ransomware groups, the managed operation has already been pointed out by Google for Android and the container escape implications are well known in the security community; therefore, the response must be proactive. To consult the KEV catalogue and confirm deadlines and requirements, visit the official CISA page: https: / / www.cisa.gov / knowledge-exploited-vulnerabilities-catalog. Keeping patches up to date, hardening container configurations and effective detection remains the best defense against these threats.