{"id":"PUB-A-222091980","details":"In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-222091980","CVE-2022-20153"],"modified":"2026-05-26T15:46:26.044149249Z","published":"2022-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/6282531a84bc3"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/dc1163203ae6e"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2022-06-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/kernel/common/+/dc1163203ae6e","target":{"file":"fs/io_uring.c"},"signature_version":"v1","signature_type":"Line","id":"PUB-A-222091980-512697e0","digest":{"threshold":0.9,"line_hashes":["14713863431515729283607372915929630473","73721988287512903752427978084083039489","206909965113241066935273885927730003046","238595084612937447669323305018404261028","207894611227891877965351819903425392602","120016117689637547751196975801191554412","301513604406674256045888246483829841860","62691881503194734638689328900835486157","51719722729921951407857325737768469856","58793450764127675124985092392227439445","173961660483178166494998022307965583271","228494980629219531657304145626732197226","262895292314214123638568828246434456673","214267295237758998542671140768996661711"]},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/6282531a84bc3","id":"PUB-A-222091980-a6b4a35a","signature_version":"v1","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["14713863431515729283607372915929630473","73721988287512903752427978084083039489","206909965113241066935273885927730003046","238595084612937447669323305018404261028","207894611227891877965351819903425392602","120016117689637547751196975801191554412","301513604406674256045888246483829841860","62691881503194734638689328900835486157","51719722729921951407857325737768469856","58793450764127675124985092392227439445","173961660483178166494998022307965583271","228494980629219531657304145626732197226","262895292314214123638568828246434456673","214267295237758998542671140768996661711"]},"target":{"file":"fs/io_uring.c"},"deprecated":false}],"severity":"Moderate","spl":"2022-06-05","fixes":["https://android.googlesource.com/kernel/common/+/6282531a84bc3","https://android.googlesource.com/kernel/common/+/dc1163203ae6e"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-222091980.json"}}],"schema_version":"1.7.5"}