CISA warns of active attacks exploiting Android, Linux bugs
CISA says hackers are exploiting an Android framework flaw and a Linux kernel privilege-escalation bug. Federal agencies must patch or stop using affected software by June 5.
Intelligence analysis by GPT-5.4 Mini
CISA has added two vulnerabilities to its Known Exploited Vulnerabilities catalog: a high-severity Android framework integer overflow and a Linux kernel privilege-escalation flaw. The agency says the Android issue affects Android 14 through 16, while the Linux bug can help local attackers escape containers and gain root on hosts.
CISA found two dangerous bugs that bad actors may already be using: one in Android phones and one in Linux computers. One bug can help someone sneak extra control on a phone, and the other can help a person break out of a locked box and take over the computer.
Analysis
What CISA added
CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog. The first is CVE-2025-48595, a high-severity integer overflow in the Android Framework that can be used to gain increased privileges. Google’s bulletin says it affects Android 14 through 16 and requires no user interaction. Google also said the flaw may be under limited targeted exploitation in the wild, but did not share technical details about the activity.
The second issue is CVE-2022-0492, a high-severity Linux kernel privilege-escalation flaw. It affects multiple kernel branches, including versions from 2.6 through 4.20 and 5.5 through 5.17. The flaw is in cgroup_release_agent_write() in the cgroups v1 subsystem. Because of insufficient authentication checks, a local attacker can bypass namespace isolation, escalate privileges, and potentially escape from a container to gain root on the host.
What defenders need to do
Google has already issued June 2026 Android patches, including the 2026-06-01 and 2026-06-05 security patch levels. For Linux, the article lists fixed versions such as 4.9.301+, 4.14.266+, 4.19.229+, 5.4.177+, 5.10.97+, 5.15.20+, 5.16.6+, and 5.17-rc3+.
Because the flaws are in KEV, U.S. federal agencies covered by BOD 22-01 must apply vendor updates and mitigations or stop using the impacted software by June 5. CISA also frames KEV as a warning system for critical infrastructure and large organizations, so the same urgency applies beyond government. Neither flaw is marked as ransomware-associated in KEV, which means CISA is signaling active exploitation without the extra ransomware flag.
Key points
- CISA added CVE-2025-48595 and CVE-2022-0492 to its Known Exploited Vulnerabilities catalog.
- The Android flaw affects Android 14 through 16 and can be exploited without user interaction.
- The Linux flaw can let a local attacker escalate privileges and potentially escape a container to root on the host.
- Federal agencies covered by BOD 22-01 must patch or stop using affected software by June 5.
- CISA says the issues are active attack concerns, even though they are not tagged as ransomware-associated.
The Android and Linux vendors have already identified fixes, so organizations have a clear patch path. If those updates are deployed quickly, exposure to both the mobile and container risks can drop sharply before attackers can widen their reach.
If patches are delayed, Android devices on affected versions and Linux systems using vulnerable kernels could remain open to privilege escalation. In container-heavy environments, the Linux flaw is especially concerning because a local foothold could become host-level access.
