{"id":"PUB-A-219513976","details":"In TBD of TBD, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-219513976","CVE-2022-20148"],"modified":"2026-05-01T15:24:27.653932Z","published":"2022-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/528611246fcbd"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/591f4296cc0ec"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2022-06-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"severity":"Moderate","fixes":["https://android.googlesource.com/kernel/common/+/528611246fcbd","https://android.googlesource.com/kernel/common/+/591f4296cc0ec"],"vanir_signatures":[{"deprecated":false,"target":{"file":"fs/f2fs/segment.c"},"signature_type":"Line","signature_version":"v1","id":"PUB-A-219513976-5b42cc8b","source":"https://android.googlesource.com/kernel/common/+/528611246fcbd","digest":{"line_hashes":["100550003805936508978399047396326224371","171810357572506426255619989224019930958","284885123953262004139666634273452505732","225098806647677938088022812972113366532"],"threshold":0.9}},{"deprecated":false,"target":{"file":"fs/f2fs/node.h"},"signature_type":"Line","signature_version":"v1","id":"PUB-A-219513976-884f6cae","source":"https://android.googlesource.com/kernel/common/+/528611246fcbd","digest":{"line_hashes":["275524825056871943550649434064986060158","18927195407250780513485689513467948271","117170156640733490049054414317855245112","75566913145128028525066547198824834806"],"threshold":0.9}},{"deprecated":false,"target":{"file":"fs/f2fs/segment.c","function":"issue_discard_thread"},"signature_type":"Function","signature_version":"v1","id":"PUB-A-219513976-968de9a4","source":"https://android.googlesource.com/kernel/common/+/528611246fcbd","digest":{"length":1211,"function_hash":"124795099909584009493040841190699187516"}},{"deprecated":false,"target":{"file":"fs/f2fs/super.c","function":"f2fs_fill_super"},"signature_type":"Function","signature_version":"v1","id":"PUB-A-219513976-969455e5","source":"https://android.googlesource.com/kernel/common/+/591f4296cc0ec","digest":{"length":10895,"function_hash":"73922163594570922536534468179859994660"}},{"deprecated":false,"target":{"file":"fs/f2fs/node.c"},"signature_type":"Line","signature_version":"v1","id":"PUB-A-219513976-c04b5e75","source":"https://android.googlesource.com/kernel/common/+/528611246fcbd","digest":{"line_hashes":["164794814252404592396856061901572293866","302718834081509623251213419733649194900","86969399921663805006140175577701133664","319820189924798219988047065114688845304","155081408156856591448869104553061554010","226454674697238250232309970998124516266","99786372657074736536655489455922278116","128713118076494478372631901848533363002","77394357389440150691911950026098680435","35990866368908636322316629771688518032","316737431451238317545788166880694529035","148153745301289592432815959347836340118"],"threshold":0.9}},{"deprecated":false,"target":{"file":"fs/f2fs/node.c","function":"f2fs_available_free_memory"},"signature_type":"Function","signature_version":"v1","id":"PUB-A-219513976-ea2d1eb6","source":"https://android.googlesource.com/kernel/common/+/528611246fcbd","digest":{"length":1479,"function_hash":"241266305705586423821221299052759637553"}},{"deprecated":false,"target":{"file":"fs/f2fs/super.c"},"signature_type":"Line","signature_version":"v1","id":"PUB-A-219513976-ebc65da1","source":"https://android.googlesource.com/kernel/common/+/591f4296cc0ec","digest":{"line_hashes":["297045096466490533789788922437153138842","113917250405168422863723285243872347872","28481845303400581227335460415412101085","337534317556263621772141779692703110544"],"threshold":0.9}}],"types":["EoP"],"spl":"2022-06-05"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-219513976.json"}}],"schema_version":"1.7.5"}