CISA warns of active attacks exploiting Android, Linux bugs

CISA warns of active attacks exploiting CVE-2025-48595, a high-severity integer overflow in Android Framework affecting versions 14 to 16, requiring no user interaction. The flaw may be under limited targeted exploitation and was patched in June 2026 security updates. CISA also added CVE-2022-0492, a privilege escalation vulnerability in Linux kernel cgroup v1, impacting versions 2.6 to 4.20 and 5.5 to 5.17, which allows attackers to gain elevated privileges without user interaction.