The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning that hackers are actively exploiting vulnerabilities in the Linux kernel and Android operating system. Two new flaws have been added to the agency’s Known Exploited Vulnerabilities (KEV) catalog, and organizations are urged to patch immediately.
The Android Vulnerability: CVE-2025-48595
The first flaw, tracked as CVE-2025-48595, is a high-severity integer overflow vulnerability in the Android Framework that can be leveraged for privilege escalation. According to Google’s security bulletin, the issue impacts Android versions 14 through 16 and requires no user interaction to exploit — making it particularly dangerous.
Google has indicated that CVE-2025-48595 may be under limited targeted exploitation in the wild, though specific details about the activity have not been disclosed. The vulnerability has been addressed with the June 2026 security patches (2026-06-01 and 2026-06-05 security patch levels). If you haven’t updated your Android device, now is the time.
The Linux Vulnerability: CVE-2022-0492
The second vulnerability, CVE-2022-0492, is a high-severity privilege escalation flaw affecting multiple Linux kernel branches — from versions 2.6 through 4.20, and 5.5 through 5.17. That this years-old vulnerability is now being actively exploited underscores the importance of keeping legacy systems patched.
The flaw resides in the cgroup_release_agent_write() function of the cgroups v1 subsystem. Due to insufficient authentication checks, a local attacker can bypass namespace isolation, escalate privileges, and potentially escape from a container to gain root-level access on the host system. According to past reports from Aqua Security and Palo Alto Networks, the issue primarily impacts containerized environments using cgroups v1 and is especially dangerous when containers are granted additional capabilities.
What You Should Do
For Android users: Install the June 2026 security update as soon as it’s available for your device. For Linux system administrators: Update your kernel to a patched version and consider migrating from cgroups v1 to cgroups v2, which is not affected by CVE-2022-0492. Organizations running containerized workloads should prioritize this fix, especially in multi-tenant environments where container escape could have severe consequences.
CISA’s KEV catalog additions serve as a de facto deadline for federal agencies, but the message is clear for everyone: these vulnerabilities are being exploited right now, and the window for proactive defense is closing.
