June 2, 2026 update: CISA added CVE-2022-0492 to the Known Exploited Vulnerabilities catalog. The short version for hosting admins is simple: if untrusted users, customer websites, containers, build jobs, or support tools can run code on a Linux machine, this belongs in the urgent kernel-patch queue.
Plain-English impact: CVE-2022-0492 is a Linux kernel privilege-escalation issue tied to the cgroups v1 release_agent feature. NVD describes the vulnerable area as cgroup_release_agent_write and rates the issue 7.8 High. CISA says it can allow privilege escalation and set a June 5, 2026 due date for covered agencies.
Who should treat this as urgent
- Shared hosting providers: cPanel, CloudLinux, DirectAdmin, Plesk, and custom hosting nodes where customer workloads share the same kernel.
- Container platforms: Docker hosts, Kubernetes workers, CI runners, build boxes, and developer sandboxes that run workloads from more than one trust level.
- Virtualization and lab hosts: Proxmox, KVM, and utility servers that run containers or allow many admins to operate on the same host.
- Business Linux servers: any system where a compromised website, cron job, SSH account, panel user, or automation token could become a local foothold.
What to do now
- Check your vendor kernel status. Use your OS vendor as the source of truth: Ubuntu, Debian, RHEL, AlmaLinux, Rocky Linux, CloudLinux, Proxmox, and managed VPS providers may backport the fix without changing to a new upstream kernel family.
- Install the kernel update through your normal package channel. Do not copy random third-party kernel builds onto production hosting nodes.
- Reboot into the fixed kernel or confirm live-patch coverage. A package update alone is not enough if the machine is still running the old kernel.
- Prioritize multi-tenant systems first. Shared hosting, container workers, CI runners, and support jump boxes deserve priority over single-purpose machines with only trusted admins.
- Review container posture. Avoid privileged containers for routine workloads, keep container runtimes updated, restrict unnecessary capabilities, and make sure old test containers are not still running with broad host access.
- Tell customers what changed. For hosting fleets, send a short maintenance note that the kernel was patched for a CISA KEV item and that a reboot window may be required.
cPanel, Proxmox, Docker, and Kubernetes notes
cPanel and WHM: Updating WHM alone does not patch a kernel issue. Patch the operating system kernel, reboot, then confirm services came back cleanly: web server, PHP-FPM, mail, DNS, database, backup agent, and monitoring.
Proxmox and KVM hosts: Plan this like any other host-kernel maintenance: snapshot or back up critical workloads first, migrate or shut down guests where practical, patch the node, reboot, then verify storage, networking, backups, and cluster quorum.
Docker and Kubernetes: The host kernel matters. Updating only an image, pod, or application package does not remove host-kernel exposure. Patch worker nodes, drain workloads safely where needed, reboot, and verify the node returned healthy before moving to the next one.
Safe verification checklist
- Confirm the system is running the fixed vendor kernel, not only that an update package was downloaded.
- Confirm live-patching tools report this CVE covered if you are relying on live patching instead of an immediate reboot.
- Check whether cgroups v1 is still required for legacy workloads and document the business reason if it cannot be retired yet.
- Review privileged containers, host mounts, legacy CI jobs, and abandoned lab workloads.
- After reboot, verify backups, monitoring, panel services, customer sites, and storage mounts.
Sources
- CISA Known Exploited Vulnerabilities catalog
- CISA KEV JSON feed
- NVD entry for CVE-2022-0492
- Ubuntu CVE tracker for CVE-2022-0492
- Upstream Linux kernel fix reference linked by CISA
- Related Fix I.T. Phill Linux kernel patch guidance for hosting providers
Need help planning a kernel reboot window for cPanel, Proxmox, Docker, or Kubernetes hosts? Open a ticket through Help4Network.com.