CISA Adds Android and Linux Flaws to KEV After Exploitation Evidence
Summary
CISA added Android CVE-2025-48595 and Linux CVE-2022-0492 to its KEV catalog. Android 14–16 are affected by the first flaw; the second can enable container escape. Federal agencies face a June 5 deadline to patch or stop using affected software.
Key points
- CISA added CVE-2025-48595 and CVE-2022-0492 to its Known Exploited Vulnerabilities catalog.
- Google said CVE-2025-48595, an Android Framework integer overflow affecting Android 14 through 16, may be under limited targeted exploitation; it requires no user interaction.
- The Android flaw was addressed in the June 2026 security patch levels 2026-06-01 and 2026-06-05.
- CVE-2022-0492 affects the Linux kernel’s cgroups v1 subsystem; a local attacker may bypass namespace isolation, escalate privileges, and potentially escape a container to host root access.
- CISA’s notice requires covered federal agencies to apply vendor updates and mitigations or stop using affected software by June 5; other organizations are urged to act with similar urgency.
Article Details
- Vulnerability Types
- Integer overflow
- Privilege escalation
- Namespace isolation bypass
- Container escape
- Severity
- High
- Affected Versions
- Android Framework: Android 14 through 16
- Linux kernel: versions 2.6 through 4.20 and 5.5 through 5.17
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Stop using the affected software if updates or mitigations are not applied.
MITRE ATT&CK
CVE
CVE-2022-0492CISA has added CVE-2025-48595 in the Android Framework and CVE-2022-0492 in the Linux kernel to its Known Exploited Vulnerabilities catalog after evidence of exploitation.CVE-2025-48595CISA has added CVE-2025-48595 in the Android Framework and CVE-2022-0492 in the Linux kernel to its Known Exploited Vulnerabilities catalog after evidence of exploitation.
Vendors
Products
Android FrameworkCISA has added CVE-2025-48595 in the Android Framework and CVE-2022-0492 in the Linux kernel to its Known Exploited Vulnerabilities catalog after evidence of exploitation.Linux kernelCISA has added CVE-2025-48595 in the Android Framework and CVE-2022-0492 in the Linux kernel to its Known Exploited Vulnerabilities catalog after evidence of exploitation.