CVE-2022-20566

What it actually does

Use-after-free in l2cap_chan_put due to improper locking in the L2CAP core allows kernel memory corruption leading to local privilege escalation.

Why it matters to the business

Local attackers can obtain full device control without user interaction, increasing risk of data compromise on affected Android systems; the large number of downstream dependents amplifies exposure across the ecosystem.

How an attack unfolds

An attacker with local access triggers the race condition in L2CAP channel reference counting to free an object while it is still referenced, then reclaims the memory to execute arbitrary code with kernel privileges.

How to fix it

Update to a fixed kernel version; for undertow-io/undertow (GIT) apply commit 2ec4d952b6c3d7c259a5dfe9a01e539b5c2ba230 or later.

How to confirm the fix worked

Verify the presence of the upstream fix commit in the kernel source tree and confirm the vulnerable l2cap_chan_put code path has been updated; test with available kernel exploit PoCs if permitted.

Typical attack path

1. Obtain local shell or app execution on target device
2. Trigger L2CAP channel operations that race with l2cap_chan_put
3. Reclaim freed object with attacker-controlled data
4. Execute payload to escalate to root/kernel privileges

How to detect it

Review kernel logs and audit trails for unexpected L2CAP channel reference errors or crashes; no named threat actors are currently associated with this issue.

What your security team should do

• Prioritize patching Android devices within the next 30 days given the 24% EPSS increase
• Apply the exact fixed commit 2ec4d952b6c3d7c259a5dfe9a01e539b5c2ba230 to undertow-io/undertow deployments
• Monitor for local privilege-escalation attempts via kernel audit logs