CVE-2022-48931

What it actually does

Concurrent execution of link_group/unlink_group during configfs_{,un}register_subsystem allows two list_del_init operations to interleave on the same list_head, corrupting next/prev pointers and triggering a kernel panic via __list_del.

Why it matters to the business

Local users or processes performing simultaneous configfs subsystem registration and unregistration can trigger immediate kernel crashes, causing denial of service and potential data loss on affected Linux systems and Android devices.

How an attack unfolds

An attacker with local access launches two processes that race to call configfs_unregister_subsystem (or register) on overlapping subsystems; the interleaving list operations corrupt internal doubly-linked lists, resulting in a panic during the next list traversal.

How to fix it

Update the Linux kernel to commit 40805099af11f68c5ca7dbcfacf455da8f99f622 or later; apply the corresponding Android patches released 2022-03-01 for versions 11, 12, and 12L in platform/packages/providers/DownloadProvider.

How to confirm the fix worked

Verify the presence of the mutex-protected link_group/unlink_group paths and the configfs_subsystem_mutex in the running kernel source or binary; confirm the fixed commit hash is present in /proc/version or via package manager.

Typical attack path

1. Obtain local execution on a system with configfs enabled
2. Trigger concurrent calls to configfs_register_subsystem and/or configfs_unregister_subsystem from separate processes or threads
3. Force the specific interleaving of list_del_init operations on shared list_heads
4. Cause kernel panic when corrupted pointers are dereferenced

How to detect it

Review kernel logs for oops or panic stack traces containing configfs_unregister_subsystem, unlink_group, list_del_init, or __list_del; correlate timestamps with processes performing configfs operations.

What your security team should do

• Prioritize patching all Linux kernels and Android devices to the listed fixed versions within standard maintenance windows
• Restrict unprivileged local access where feasible until patches are deployed
• Monitor for kernel oops/panic reports related to configfs list operations