CVE-2022-20153

What it actually does

Use-after-free in rcu_cblist_dequeue of rcu_segcblist.c caused by improper locking, enabling local kernel privilege escalation when system execution privileges are already held.

Why it matters to the business

Devices running vulnerable Android kernels face risk of deeper system compromise by attackers who already possess high privileges, potentially leading to full device control, data exposure, or persistence; low exploit likelihood reduces immediate urgency but patching remains necessary for kernel integrity.

How an attack unfolds

An attacker with existing system execution privileges crafts inputs to invoke the RCU callback list dequeue path, triggering the use-after-free condition to corrupt kernel memory structures and elevate to higher privileges without user interaction.

How to fix it

Apply the upstream kernel fix referenced by Android ID A-222091980; update affected Android kernels to patched versions that correct the improper locking in rcu_segcblist.c.

How to confirm the fix worked

Confirm kernel source includes the locking fix in rcu_segcblist.c, verify device kernel version against patched Android releases, and perform targeted testing of RCU callback paths for absence of use-after-free conditions.

Typical attack path

1. Acquire system execution privileges on the Android device
2. Invoke rcu_cblist_dequeue through targeted kernel operations that expose the locking flaw
3. Exploit the resulting use-after-free to achieve kernel-level code execution

How to detect it

Inspect kernel logs and crash reports for RCU callback list anomalies or use-after-free signatures; correlate with any observed privilege escalation attempts from system-level processes.

What your security team should do

• Patch Android kernels on all managed devices at the earliest maintenance window
• Review and minimize processes running with system execution privileges
• Monitor EPSS and exploit maturity indicators for any future increase in risk