CVE-2022-48740

What it actually does

Double free of cond_list structure on error paths in cond_read_list() and duplicate_policydb_cond_list() leads to NULL pointer dereference after cond_list_destroy() is invoked twice.

Why it matters to the business

Kernel instability or denial of service on Linux systems enforcing SELinux policies, with higher urgency for Android kernel deployments given the large number of downstream dependents.

How an attack unfolds

An attacker triggers error conditions during SELinux conditional policy list processing or policy database duplication, causing the double free and subsequent NULL dereference; threat actors targeting Android kernel remote code execution paths may chain this into broader kernel compromise.

How to fix it

Apply the upstream fix in commit f446089a268c8fc6908488e991d28a9b936293db or upgrade to a kernel containing the corrected cond_list_destroy() logic that resets cond_list_len to 0 and the pointer to NULL.

How to confirm the fix worked

Confirm the presence of the fix commit in the kernel source tree; load SELinux policies while injecting controlled error conditions and verify no double-free or NULL dereference occurs.

Typical attack path

1. Trigger error path in cond_read_list() or duplicate_policydb_cond_list() via malformed or conflicting SELinux policy input
2. Invoke cond_list_destroy() from the error handler
3. Allow caller to invoke cond_list_destroy() a second time
4. Cause NULL pointer dereference leading to kernel panic or exploitable state

How to detect it

Review kernel logs for NULL pointer dereference oopses or crashes referencing cond_list_destroy, cond_read_list, or duplicate_policydb_cond_list; correlate with SELinux policy load failures.

• cond_list_destroy
• cond_read_list
• duplicate_policydb_cond_list
• NULL pointer dereference in SELinux conditional list handling

What your security team should do

• Prioritize kernel updates containing f446089a268c8fc6908488e991d28a9b936293db on all SELinux-enabled systems
• Monitor for kernel oops reports involving SELinux conditional lists
• Test policy loading error paths in staging environments after patching