# CISA Orders Emergency Patching for Critical Android and Linux Privilege Escalation Flaws Under Active Attack
## The Threat
The U.S. Cybersecurity and Infrastructure Security Agency has escalated two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, signaling that both flaws are already being weaponized in targeted attacks. CVE-2025-48595, a high-severity integer overflow flaw in the Android Framework, requires no user interaction to exploit and grants attackers the ability to escalate privileges on Android 14 through Android 16 devices. According to Google's security bulletin, the vulnerability may be under limited targeted exploitation, though the company did not disclose specifics about the scope or nature of the attacks.
The second vulnerability, CVE-2022-0492, is a privilege escalation flaw in the Linux kernel's cgroups v1 subsystem that poses an even more dramatic risk: it enables local attackers to escape container isolation entirely and gain root-level access on the underlying host system. Originally documented in 2022, the flaw has now been marked as actively exploited, making it a persistent concern across containerized infrastructure and cloud environments worldwide.
Together, these vulnerabilities expose two of the most critical layers of modern computing—mobile devices and cloud infrastructure—to privilege escalation attacks. The CISA KEV designation means federal agencies operating under the Binding Operational Directive (BOD 22-01) have until June 5, 2026 to either patch the affected systems or cease their use entirely. For other critical infrastructure operators and enterprise organizations, the urgency is just as acute.
## Severity and Impact
| Vulnerability | CVE Number | CVSS Score | Vector / Attack Type | Authentication Required | User Interaction | Affected Systems |
|---|---|---|---|---|---|---|
| Android Framework Integer Overflow | CVE-2025-48595 | 8.4 (High) | Local/Network via privileged process | Yes (local context) | None | Android 14–16 |
| Linux Kernel cgroups Privilege Escalation | CVE-2022-0492 | 8.8 (High) | Local (container escape) | No (local attacker) | None | Linux 2.6–4.20, 5.5–5.17 |
Both vulnerabilities permit privilege escalation with no user interaction required, making them ideal vectors for automated exploitation. CVE-2025-48595 affects the Android Framework's privilege model, while CVE-2022-0492 specifically targets container isolation mechanisms—a critical control in modern cloud and edge deployments.
## Affected Products
Android Operating System:
Linux Kernel Versions (CVE-2022-0492):
Patched Linux Kernel Versions:
Organizations using containerized infrastructure with cgroups v1 enabled are at heightened risk, particularly those running containers with elevated or overly permissive capability sets.
## Mitigations
For Android Users and Organizations:
For Linux and Container Operators:
For Federal Agencies (BOD 22-01 Compliance):
## References
---
## HackWire Analysis
What makes this CISA KEV alert particularly significant is not just the presence of two high-severity flaws, but the contrast in their exploitation profiles and the infrastructure layers they expose.
CVE-2022-0492 is a four-year-old vulnerability that has evidently remained dormant in terms of widespread exploitation—until now. The fact that a Linux kernel privilege escalation enabling container escape is only now being marked as actively exploited suggests either a recent shift in attacker sophistication or a specific incident that prompted disclosure. Container escape techniques are among the most valuable exploits in a cloud environment, as they transform a compromise of a single containerized application into full control of the host system and potentially the entire cluster. The risk compounds dramatically in shared cloud environments and Kubernetes deployments where container density is high.
The Android Framework flaw (CVE-2025-48595) operates on a different threat surface entirely, but the pattern is consistent: attackers are targeting privilege escalation mechanisms across both mobile and cloud infrastructure. This suggests a coordinated focus on breaking Android's security model and Linux's containerization boundaries—two of the foundational security mechanisms of modern computing.
Notably, neither vulnerability is yet associated with ransomware campaigns, which typically move more slowly and favor known, battle-tested exploits. This narrow window—where these flaws are confirmed under active use but not yet weaponized at scale by organized extortion groups—is precisely when patches are most effective. Organizations that delay patching beyond the June 5 deadline risk being targeted by both opportunistic attackers and eventual ransomware campaigns that will inevitably adopt these techniques.
The urgency is amplified for container operators and cloud infrastructure teams. A single misconfigured pod or container with excessive capabilities can become the pivot point for a complete host compromise. This is not a hypothetical threat; it is the mechanism by which containerized environments have been breached in the past.
Federal agencies have five days. Everyone else should treat that as their benchmark, not their deadline. — HackWire Editorial
## Related Coverage