CVE-2021-1048: Android kernel eventpoll use-after-free allows local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a kernel use-after-free enabling local privilege escalation and is listed in CISA KEV as exploited in the wild, though it requires local access and has low EPSS probability.

What it is

The Android kernel's eventpoll.c ep_loop_check_proc routine contains a use-after-free that can corrupt memory. Because the flaw is reachable by a local process without extra privileges, it can be used to escalate to kernel-level code execution on affected devices.

Impact

An attacker with local code execution on the device can corrupt kernel memory and escalate privileges, gaining control at the kernel level. This can defeat the application sandbox and enable further compromise of the device.

Attack surface

The vulnerability is local (CVSS AV:L) and requires low privileges (PR:L) with no user interaction (UI:N). It is reached by a local process invoking the eventpoll interface; no remote vector or authentication beyond local execution is described.

Exploitation

CVE-2021-1048 is listed in CISA's Known Exploited Vulnerabilities catalog with a 2022-05-23 addition date, indicating exploitation in the wild. EPSS 30-day probability is 0.01039 (62nd percentile), and no ransomware campaign use is documented.

What to do

• Apply the Android security bulletin 2021-11-01 updates or later vendor kernel patches for affected devices.
• Track and enforce minimum Android security patch levels across managed devices.
• Restrict installation of untrusted applications and limit local code execution paths on sensitive devices.
• Monitor vendor advisories for updated kernel builds and re-image devices that cannot be patched.

Detection

• Monitor for unexpected privilege escalation or kernel crash/panic events on Android devices.
• Correlate device logs for abnormal eventpoll/epoll usage by untrusted applications.
• Track devices reporting security patch levels older than 2021-11-01 as exposed.
• Review mobile threat defense or EDR telemetry for local exploit attempts against the kernel.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.