Federal cybersecurity officials are sounding the alarm over two critical vulnerabilities that threat actors are actively exploiting to compromise Android devices and Linux-based systems across enterprise environments.
The Cybersecurity and Infrastructure Security Agency has added both flaws to its Known Exploited Vulnerabilities catalog, triggering mandatory remediation timelines for federal agencies and serving as an urgent warning for private sector organizations managing similar technology stacks.
Android Framework Under Siege
The first vulnerability, designated CVE-2025-48595, represents a particularly concerning threat to Android deployments. This integer overflow flaw within the Android Framework enables attackers to escalate privileges without requiring any user interaction—making it an ideal candidate for stealth attacks.
The vulnerability affects Android versions 14 through 16, encompassing millions of devices across consumer and enterprise environments. While Google has confirmed limited targeted exploitation in the wild, the company has remained tight-lipped about specific attack campaigns or technical implementation details.
Security researchers note that the lack of user interaction requirements significantly lowers the barrier for exploitation, potentially enabling automated attacks against vulnerable Android deployments at scale.
Linux Kernel Exposes Container Environments
The second vulnerability, CVE-2022-0492, poses severe risks to containerized infrastructure running on affected Linux kernel versions. This privilege escalation flaw targets the cgroups v1 subsystem, specifically the 'cgroup_release_agent_write()' function.
The vulnerability's impact extends far beyond simple privilege escalation. Attackers who successfully exploit this flaw can bypass namespace isolation, escape container boundaries, and achieve root-level access on host systems—effectively compromising entire containerized environments.
The affected kernel versions span nearly a decade of releases, from legacy 2.6 branches through more recent 5.17 versions, indicating widespread exposure across enterprise Linux deployments.
Organizations relying on containerized workloads face particular risk, as successful exploitation can lead to complete infrastructure compromise through container escape techniques.
Elevated Risk in Container Deployments
Security analysis reveals that containerized environments using cgroups v1 face heightened exposure, especially when containers operate with elevated capabilities. This configuration, while sometimes necessary for specific workloads, creates additional attack surface that threat actors can exploit to move laterally through infrastructure.
The container escape potential makes this vulnerability especially dangerous for cloud-native organizations and enterprises running microservices architectures where container isolation serves as a critical security boundary.
Patching Status and Availability
Both vulnerabilities have vendor-supplied patches available. Google addressed the Android flaw through its June 2026 security updates, distributed via security patch levels 2026-06-01 and 2026-06-05.
For Linux environments, updated kernel versions include:
Federal agencies operating under Binding Operational Directive 22-01 face a strict remediation deadline, but private sector organizations should treat these vulnerabilities with equivalent urgency given their active exploitation status.
What You Should Do
Immediate action is required across multiple technology domains:
- Android Device Management: Deploy June 2026 security patches across all managed Android devices running versions 14-16. Prioritize devices with administrative access or handling sensitive data.
- Linux Infrastructure: Audit all Linux systems for affected kernel versions and schedule immediate updates to patched releases. Pay special attention to containerized environments and systems running with elevated privileges.
- Container Security Review: Evaluate container configurations for unnecessary elevated capabilities and implement additional isolation controls where possible.
- Monitoring Enhancement: Implement detection rules for privilege escalation attempts and unusual container activity that could indicate exploitation attempts.
Organizations should also conduct thorough security assessments of their Android and Linux deployments to identify any signs of compromise, as the limited details about ongoing exploitation campaigns suggest these vulnerabilities may have been exploited more broadly than initially reported.
