A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1

#!/usr/bin/env bash
# check-cve-2022-0492.sh
# Purpose: conservative host-side check for CVE-2022-0492
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

status="UNKNOWN"
reason="Insufficient evidence to determine patch state safely"

krel="$(uname -r 2>/dev/null || true)"
kbase="${krel%%-*}"

os_id="unknown"
os_ver="unknown"
if [ -r /etc/os-release ]; then
  # shellcheck disable=SC1091
  . /etc/os-release
  os_id="${ID:-unknown}"
  os_ver="${VERSION_ID:-unknown}"
fi

have_cgv1="no"
if grep -Eq ' - cgroup ' /proc/self/mountinfo 2>/dev/null; then
  have_cgv1="yes"
fi

verlt() {
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

verge() {
  [ "$1" = "$2" ] || ! verlt "$1" "$2"
}

set_result() {
  status="$1"
  reason="$2"
}

check_ubuntu() {
  case "$os_ver" in
    22.04|24.04|24.10|25.04|25.10)
      set_result "PATCHED" "Ubuntu release marked not affected by Canonical"
      return
      ;;
    21.10)
      if verlt "$kbase" "5.13.0"; then
        set_result "UNKNOWN" "Unexpected Ubuntu 21.10 kernel string: $krel"
      elif verlt "$krel" "5.13.0-37.42"; then
        set_result "VULNERABLE" "Ubuntu 21.10 kernel predates Canonical fixed build 5.13.0-37.42"
      else
        set_result "PATCHED" "Ubuntu 21.10 kernel is at or above Canonical fixed build 5.13.0-37.42"
      fi
      return
      ;;
    20.04)
      if verlt "$krel" "5.4.0-105.119"; then
        set_result "VULNERABLE" "Ubuntu 20.04 kernel predates Canonical fixed build 5.4.0-105.119"
      else
        set_result "PATCHED" "Ubuntu 20.04 kernel is at or above Canonical fixed build 5.4.0-105.119"
      fi
      return
      ;;
    18.04)
      if verlt "$krel" "4.15.0-173.182"; then
        set_result "VULNERABLE" "Ubuntu 18.04 kernel predates Canonical fixed build 4.15.0-173.182"
      else
        set_result "PATCHED" "Ubuntu 18.04 kernel is at or above Canonical fixed build 4.15.0-173.182"
      fi
      return
      ;;
    16.04)
      if verlt "$krel" "4.4.0-222.255"; then
        set_result "VULNERABLE" "Ubuntu 16.04 kernel predates Canonical fixed build 4.4.0-222.255"
      else
        set_result "PATCHED" "Ubuntu 16.04 kernel is at or above Canonical fixed build 4.4.0-222.255"
      fi
      return
      ;;
  esac
}

check_generic_upstream() {
  # If the kernel release string has distro packaging suffixes, upstream-only checks are unreliable.
  if [ "$krel" != "$kbase" ] && printf '%s' "$krel" | grep -Eq '(generic|amd64|el[0-9]|uek|aws|azure|gcp|oracle|fc[0-9]|amzn)'; then
    set_result "UNKNOWN" "Distro/backport kernel detected ($krel); exact vendor advisory needed"
    return
  fi

  if verlt "$kbase" "4.9.301"; then
    if verge "$kbase" "2.6.24"; then
      set_result "VULNERABLE" "Kernel falls in an upstream vulnerable range before 4.9.301"
      return
    fi
  fi

  if verge "$kbase" "4.10" && verlt "$kbase" "4.14.266"; then
    set_result "VULNERABLE" "Kernel falls in upstream vulnerable range 4.10 to <4.14.266"
    return
  fi

  if verge "$kbase" "4.15" && verlt "$kbase" "4.19.229"; then
    set_result "VULNERABLE" "Kernel falls in upstream vulnerable range 4.15 to <4.19.229"
    return
  fi

  if verge "$kbase" "4.20" && verlt "$kbase" "5.4.177"; then
    set_result "VULNERABLE" "Kernel falls in upstream vulnerable range 4.20 to <5.4.177"
    return
  fi

  if verge "$kbase" "5.5" && verlt "$kbase" "5.10.97"; then
    set_result "VULNERABLE" "Kernel falls in upstream vulnerable range 5.5 to <5.10.97"
    return
  fi

  if verge "$kbase" "5.11" && verlt "$kbase" "5.15.20"; then
    set_result "VULNERABLE" "Kernel falls in upstream vulnerable range 5.11 to <5.15.20"
    return
  fi

  if verge "$kbase" "5.16" && verlt "$kbase" "5.16.6"; then
    set_result "VULNERABLE" "Kernel falls in upstream vulnerable range 5.16 to <5.16.6"
    return
  fi

  if verge "$kbase" "5.17"; then
    set_result "PATCHED" "Kernel is newer than the affected upstream branches"
    return
  fi

  set_result "UNKNOWN" "Kernel version not safely classifiable with generic upstream logic"
}

if [ -z "$krel" ]; then
  echo "UNKNOWN - unable to read kernel release"
  exit 2
fi

if [ "$os_id" = "ubuntu" ]; then
  check_ubuntu
else
  check_generic_upstream
fi

# Add context about cgroup v1 exposure without changing patch verdict.
context="kernel=$krel os=$os_id/$os_ver cgroup_v1=$have_cgv1"

echo "$status - $reason ($context)"
case "$status" in
  PATCHED) exit 0 ;;
  VULNERABLE) exit 1 ;;
  *) exit 2 ;;
esac