What’s Vulnerable › Vulnerabilities

CVE-2022-48740: selinux: fix double free of cond_list on error paths

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-20 · updated 2026-06-17
• Weakness: CWE-415

Description

In the Linux kernel, the following vulnerability has been resolved: selinux: fix double free of cond_list on error paths On error path from cond_read_list() and duplicate_policydb_cond_list() the cond_list_destroy() gets called a second time in caller functions, resulting in NULL pointer deref. Fix this by resetting the cond_list_len to 0 in cond_list_destroy(), making subsequent calls a noop. Also consistently reset the cond_list pointer to NULL after freeing. [PM: fix line lengths in the description]

Affected products

• Linux kernel: from 5.7 before 5.10.99; from 5.11 before 5.15.22; from 5.16 before 5.16.8; 5.17-rc1, 5.17-rc2 — fixed in 5.10.99, 5.15.22, 5.16.8

How to fix

Upgrade to a fixed version: Linux kernel 5.10.99, 5.15.22, 5.16.8. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/186edf7e368c40d06cf727a1ad14698ea67b74ad
• https://git.kernel.org/stable/c/70caa32e6d81f45f0702070c0e4dfe945e92fbd7
• https://git.kernel.org/stable/c/7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4
• https://git.kernel.org/stable/c/f446089a268c8fc6908488e991d28a9b936293db
• https://git.kernel.org/stable/c/186edf7e368c40d06cf727a1ad14698ea67b74ad
• https://git.kernel.org/stable/c/70caa32e6d81f45f0702070c0e4dfe945e92fbd7
• https://git.kernel.org/stable/c/7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4
• https://git.kernel.org/stable/c/f446089a268c8fc6908488e991d28a9b936293db

Get alerted when CVE-2022-48740 or the next vulnerability affects your stack