The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities—one affecting the Android operating system and the other impacting various Linux kernel versions—to its Known Exploited Vulnerabilities (KEV) catalog. This designation signals that these flaws are actively being exploited in the wild, demanding immediate attention from system administrators and developers.
What Happened
CISA added CVE-2025-48595, a high-severity integer overflow vulnerability in the Android Framework, to its KEV list. This flaw affects Android versions 14 through 16 and, critically, requires no user interaction to exploit. Google’s security bulletin indicates limited targeted exploitation, although specific details remain scarce. Additionally, CISA flagged CVE-2022-0492, a high-severity privilege escalation flaw in the Linux kernel impacting versions from 2.6 to 4.20 and from 5.5 to 5.17. This vulnerability resides in the cgroups v1 subsystem and allows local attackers to bypass namespace isolation and potentially gain root access, especially in containerized environments.
Specifically, CVE-2022-0492 allows attackers to exploit insufficient authentication checks within the cgroup_release_agent_write() function. Prior reporting from Aqua Security and Palo Alto Networks highlight the risk to containerized environments with elevated capabilities.
Federal agencies are mandated by Binding Operational Directive (BOD) 22-01 to address KEV vulnerabilities, with a deadline of June 5th. However, CISA’s KEV serves as a critical warning for all organizations, urging them to prioritize these patches.
Why It Matters
For Android developers and system administrators, CVE-2025-48595 presents a significant risk due to its zero-interaction exploitability. This means an attacker can compromise a device simply by delivering a malicious payload, without requiring any action from the user. The fact that Google acknowledges limited targeted exploitation underscores the urgency of applying the June 2026 security patches (2026-06-01 and 2026-06-05).
On the Linux side, the vulnerability (CVE-2022-0492) is particularly concerning for organizations heavily reliant on containerization. The potential for container escape and root-level access on the host system represents a major security breach. Organizations using cgroups v1 should verify their container configurations and apply the appropriate kernel updates (4.9.301+, 4.14.266+, 4.19.229+, 5.4.177+, 5.10.97+, 5.15.20+, 5.16.6+, 5.17-rc3+). It is important to note that CISA has not flagged these vulnerabilities as being exploited by ransomware groups, but this does not diminish the overall risk.
What To Watch
Currently, details regarding the specific exploitation of CVE-2025-48595 remain limited. It will be critical to monitor Google’s security updates and security research reports for further technical details and indicators of compromise. For CVE-2022-0492, organizations should continue to assess their container security posture and ensure they are running patched kernel versions. The long lifespan of affected Linux kernels suggests a continued risk for organizations slow to update. Watch for further analysis on the scope and impact of these vulnerabilities as more information becomes available.