CVE-2025-48581 AI-generated analysis

platform/system/apex, patchlevel (build rule for the mainline patch level feature declaration)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (2 corrections). Verify against the commit before relying on it.

Adds sub_dir: "sysconfig" to the apexd.mainline_patch_level_2 prebuilt_etc module in platform/system/apex so the com.google.android.mainline.patchlevel.2.xml feature declaration is installed under the sysconfig directory, where it becomes accessible to the device.

Root cause

patchlevel/Android.bp defined prebuilt_etc "apexd.mainline_patch_level_2" with src com.google.android.mainline.patchlevel.2.xml but no sub_dir, so the XML was installed directly under the etc directory instead of etc/sysconfig. Per the commit message, the device therefore could not access the feature it declares. In general, system feature declarations in XML are read from the etc/sysconfig directory (general platform knowledge), so a file placed one level up is not picked up.

How the fix works

• patchlevel/Android.bp, module apexd.mainline_patch_level_2: adds `sub_dir: "sysconfig"` to the prebuilt_etc rule. This moves the install location of com.google.android.mainline.patchlevel.2.xml to the sysconfig subdirectory of the partition's etc directory. No other files change, and src and filename_from_src stay the same.
• The 16 commit 117f34be6322 is a cherry-pick (cherry picked from 8b89163d, Cherrypick-From 9c3d1d96). Commit 8b89163d61b8, present in android-17.0.0_r1, has identical content. The commit message says it was tested with GtsOsTestCases.

Completeness

• The fix only changes where the single XML file is installed. It does not change the XML content, apexd, or any runtime consumer. The material does not show those consumers, so the code does not tell us whether anything else depended on the old location.
• At the fixed tag, apexd.mainline_patch_level_2 is the only module in patchlevel/Android.bp, so no sibling module in this file can have the same missing sub_dir.

Behavior changes

• com.google.android.mainline.patchlevel.2.xml is now installed under etc/sysconfig/ instead of etc/ on the target partition. Per the commit message, the feature it declares becomes accessible to the device.

Per major

• Android 14: not affected per the bulletin; patchlevel/Android.bp is absent at android-security-14.0.0_r29 (code absent).
• Android 15: not affected per the bulletin; patchlevel/Android.bp is absent at android-security-15.0.0_r17 (code absent).
• Android 16: same fix: commit 117f34be6322 (cherry-picked from 8b89163d) in android-security-16.0.0_r7; at android-security-16.0.0_r8 all 3 lines of the patched region are present.
• Android 17: same fix: commit 8b89163d61b8 (identical diff, linked by related_bug) in android-17.0.0_r1; at android-security-17.0.0_r1 all 3 lines of the patched region are present.

Unknowns

• The material does not show which runtime component reads com.google.android.mainline.patchlevel.2.xml, or the concrete EoP consequence of the feature being missing.
• The content of com.google.android.mainline.patchlevel.2.xml and the partition or APEX the module is packaged into are not shown.
• Neither the diff nor the commit message explains why bug 436433817 was rated High EoP.
• Whether 8b89163d or 9c3d1d96 is the original upstream commit.

Back to June 2026 · Findings