Linux and Android KEV Fleet Check: Platform Bugs That Survive in the Corners

On June 2, 2026, the CISA KEV catalog included two platform-level reminders: CVE-2022-0492 in the Linux kernel and CVE-2025-48595 in Android Framework.

Neither should be handled as a generic "patch someday" ticket. Platform bugs persist in forgotten places: old Kubernetes nodes, appliance-like Linux hosts, lab servers, contractor laptops, unmanaged Android devices, field tablets, kiosks, and executive phones.

Linux cgroups: old bug, current exposure

CVE-2022-0492 involves the cgroups v1 release_agent feature. In practical terms, defenders should think about privilege escalation and container-host escape conditions.

Fleet checks:

1. Find Linux hosts still exposing cgroups v1.
2. Identify privileged containers and containers with sensitive host mounts.
3. Check Kubernetes node age, kernel baselines, and container runtime versions.
4. Hunt for unusual writes or executions touching cgroup paths.
5. Review lab, build, CI, and edge hosts separately from the clean corporate baseline.

The most dangerous Linux host is often the one not in the dashboard.

Android Framework: mobile fleet reality

CVE-2025-48595 is described by CISA as an Android Framework integer overflow that can allow local privilege escalation/code execution. That means the response belongs with MDM, device compliance, user risk, and app control.

Fleet checks:

• Patch status by device model and carrier.
• Unsupported Android versions in the fleet.
• Privileged or high-risk users with stale devices.
• Sideloading permissions and developer mode exposure.
• Lost, shared, kiosk, and field devices outside normal update rings.

For executives and administrators, mobile exposure can become identity exposure. Treat mobile fleet hygiene as part of your identity control plane.

FLLC operating note

This is where network/IT/cybersecurity work blends. A vulnerability manager sees two CVEs. A defender sees container boundaries, mobile identity, asset inventory quality, patch rings, and telemetry gaps.

The practical output should be:

1. A list of affected Linux and Android assets.
2. A patch and isolation timeline.
3. A short hunt package.
4. A residual-risk note for assets that cannot be patched immediately.

References

• CISA Known Exploited Vulnerabilities Catalog
• Linux kernel commit referenced by CISA for CVE-2022-0492
• Android Security Bulletin - June 2026