CVE-2022-20158

What it actually does

Use-after-free in bdi_put and bdi_unregister leads to memory corruption in the kernel backing device interface when references are mishandled.

Why it matters to the business

Devices remain exposed to memory corruption attacks for over four years with no listed fixed versions, increasing risk of kernel-level compromise on Android systems despite low exploit probability.

How an attack unfolds

An attacker with system execution privileges triggers the race or reference-counting error in backing-dev.c to reuse freed memory structures, achieving arbitrary kernel memory corruption without user interaction.

How to fix it

Apply the upstream Linux kernel fix referenced by Android ID A-182815710 and update to a patched Android kernel build; monitor vendor security bulletins for device-specific updates since no fixed versions are listed.

How to confirm the fix worked

Confirm the device kernel version incorporates the backing-dev.c changes that eliminate the use-after-free; review kernel build logs and compare against the upstream commit for A-182815710.

Typical attack path

1. Obtain system execution privileges on the target device
2. Invoke or manipulate code paths reaching bdi_put or bdi_unregister
3. Trigger use-after-free condition to corrupt kernel memory
4. Leverage corruption for privilege escalation or further kernel control

How to detect it

Review kernel logs and audit records for repeated or anomalous calls involving bdi_put or bdi_unregister around the time of suspected privilege changes; correlate with process execution history showing system-level activity.

What your security team should do

• Prioritize kernel updates on all Android devices given the 1529-day exposure window
• Restrict system execution privileges to the minimum necessary processes
• Monitor EPSS and exploit maturity trends for any increase in activity