CVE-2021-0920: Android kernel AF_UNIX use-after-free race condition

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe CVSS score is only medium (6.4) and exploitation requires local System privileges, but confirmed KEV listing means real-world exploitation is known and patching should not be deferred.

What it is

A race condition in unix_scm_to_skb() in af_unix.c of the Android kernel can cause a use-after-free. The flaw is reachable locally and, per the record, requires System execution privileges to trigger, making it a privilege-escalation primitive rather than a remote attack. It matters because it affects the Android kernel and Debian's Linux kernel packages, and CISA added it to the Known Exploited Vulnerabilities catalog.

Impact

An attacker who already holds System-level execution privileges can exploit the use-after-free to escalate to higher privileges, with high impact to confidentiality, integrity and availability per the CVSS vector. No user interaction is needed.

Attack surface

The vector is local (AV:L) with high attack complexity and high privileges required (PR:H), and no user interaction (UI:N). It is reached through AF_UNIX socket handling in the kernel, so an attacker needs existing code execution at System level on the target device or host.

Exploitation

CISA added this to the KEV catalog on 2022-05-23 with a 2022-06-13 remediation due date, indicating known exploitation in the wild. EPSS is low at roughly 0.85% 30-day probability (56th percentile), and no ransomware campaign use is documented.

What to do

• Apply the Android security bulletin 2021-11-01 update and the corresponding Linux kernel and Debian LTS fixes for the affected kernel packages.
• Restrict and monitor local code execution paths that could grant System-level privileges on Android devices and Linux hosts.
• Track KEV remediation deadlines and confirm patched kernel builds across Android and Debian fleets.
• Where patching is delayed, reduce exposure by limiting untrusted local processes and enforcing least privilege on device and host accounts.

Detection

• Monitor for kernel crashes or use-after-free reports tied to AF_UNIX socket operations in dmesg and kernel logs.
• Hunt for privilege-escalation behavior from processes already running at System level, especially unusual AF_UNIX socket activity.
• Correlate endpoint telemetry for local exploit attempts against kernel versions predating the November 2021 Android bulletin or equivalent Debian fixes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.