CISA has warned that attackers are actively exploiting two vulnerabilities affecting Android and Linux systems. The first, CVE-2025-48595, is a high-severity integer overflow vulnerability in the Android Framework that can allow privilege escalation. Google has stated that the issue affects Android 14 through Android 16 and requires no user interaction for exploitation, making timely patching especially important. The flaw has been fixed in the June 2026 Android security patches. 

The second vulnerability, CVE-2022-0492, affects the Linux kernel’s cgroups v1 subsystem. This flaw can allow a local attacker to bypass namespace isolation, escalate privileges, and potentially escape from a container to gain root-level access on the host system. That is particularly serious for containerized environments, where one weak boundary can turn into full host compromise, because apparently attackers do read architecture diagrams better than many defenders do. 

Why This Matters 

These vulnerabilities show why patching cannot be limited only to internet-facing applications. Mobile operating systems, Linux kernels, and container infrastructure are all high-value targets. Attackers often chain vulnerabilities together, using one weakness for initial access and another for privilege escalation or lateral movement.

The Android flaw is especially concerning because mobile devices are now used for email, banking, business apps, MFA approvals, and corporate communication. A compromised phone is no longer just a personal inconvenience. It can become an entry point into business systems.

The Linux vulnerability is equally important for organizations running servers, cloud workloads, containers, and DevOps environments. Container security depends heavily on isolation. If an attacker can break out of a container and reach the host, the impact can move from one workload to the wider infrastructure very quickly.

What Organizations Should Do 

Organizations should urgently review Android device patch levels and ensure devices are updated to the June 2026 security patch level. For managed devices, MDM policies should enforce minimum patch levels, restrict outdated devices, and monitor risky configurations.

For Linux environments, administrators should identify systems using affected kernel versions and cgroups v1, especially in containerized workloads. They should apply vendor patches, reduce unnecessary container privileges, avoid running containers with excessive capabilities, and monitor for suspicious privilege escalation attempts.

Security teams should also review logs for abnormal container behavior, unexpected root access, suspicious namespace activity, and unusual process execution. Patching is critical, but visibility matters too. Otherwise, the organization is just hoping silently, which remains a surprisingly popular security strategy.

Final Comment 

CISA’s warning is a reminder that exploited vulnerabilities are not theoretical risks. Once a flaw enters the Known Exploited Vulnerabilities catalog, organizations should treat it as an active threat, not as a future maintenance task for some mythical quiet weekend.

The key lesson is simple: patch mobile devices, update Linux kernels, harden containers, and monitor privilege escalation paths. Attackers are actively looking for weak operating system and kernel-level controls because once they gain higher privileges, security tools often become easier to bypass. Modern security must therefore protect not only applications, but also the platforms and infrastructure underneath them.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting vulnerabilities in the Linux kernel and Android operating system. [...]

Source: CISA warns of active attacks exploiting Android, Linux bugs via Bleeping Computer — published 03 Jun 2026.