{"id":263094,"date":"2026-06-03T11:36:00","date_gmt":"2026-06-03T15:36:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/06\/03\/cisa-warns-of-active-attacks-exploiting-android-linux-bugs\/"},"modified":"2026-06-03T11:55:12","modified_gmt":"2026-06-03T15:55:12","slug":"cisa-warns-of-active-attacks-exploiting-android-linux-bugs","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/06\/03\/cisa-warns-of-active-attacks-exploiting-android-linux-bugs\/","title":{"rendered":"CISA warns of active attacks exploiting Android, Linux bugs"},"content":{"rendered":"

CISA warns of active attacks exploiting Android, Linux bugs<\/a><\/p>\n

https:\/\/www.bleepingcomputer.com\/news\/security\/cisa-warns-of-active-attacks-exploiting-android-linux-bugs\/<\/a><\/p>\n

Publish Date: 2026-06-03 11:36:00<\/a><\/p>\n

Source Domain: www.bleepingcomputer.com<\/a><\/p>\n

\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting vulnerabilities in the Linux kernel and Android operating system.<\/p>\n

The most recent flaw the agency added to its Known Exploited Vulnerabilities (KEV) catalog, CVE-2025-48595, is a high-severity integer overflow vulnerability in the Android Framework, which can be leveraged for increased privileges.<\/p>\n

According to Google\u2019s recent security bulletin, the security issue impacts Android 14 through 16, and requires no user interaction to exploit.<\/p>\n

\"image\"<\/p>\n

Google indicated that CVE-2025-48595 may be under limited targeted exploitation in the wild, but provided no specific details about the activity or technical information about the flaw or the incidents.<\/p>\n

The issue has been addressed with the release of June 2026 security patches (2026-06-01 and 2026-06-05 security patch levels).<\/p>\n

The second vulnerability CISA added to KEV is tracked as CVE-2022-0492, a high-severity privilege escalation flaw that impacts multiple Linux kernel branches, from 2.6 through 4.20, and from 5.5 through 5.17.<\/p>\n

The flaw lies in the \u2018cgroup_release_agent_write()\u2019 function of the cgroups v1 subsystem, which, due to insufficient authentication checks, can be abused by a local attacker to bypass namespace isolation, escalate privileges, and potentially escape from a container to gain root-level access on the host system.<\/p>\n

According to past reports from Aqua Security and Palo Alto Networks, the issue primarily impacts containerized environments using cgroups v1, and is especially dangerous when containers are granted elevated capabilities.<\/p>\n

The Linux kernel versions that address the issue are:<\/p>\n