CVE-2021-0920: Android Kernel Race Condition Vulnerability

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: yes — in CISA KEV since 2022-05-23
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-15 · updated 2026-06-17
Weakness: CWE-362

Description

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel

Affected products

Debian Linux: 9.0
Android: all versions
Linux kernel: through 5.13; 5.14-rc1, 5.14-rc2, 5.14-rc3

References

https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-0920

Get alerted when CVE-2021-0920 or the next vulnerability affects your stack