Linux Kernel & Android af_unix.c Use-After-Free Local Privilege Escalation Vulnerability (CVE-2021-0920)
Executive & SecOps Summary
SECOPS ASSESSMENTAndroid kernel and Linux kernel implementations of AF_UNIX sockets
Local attackers can exploit this to gain System execution privileges without any user interaction, leading to full device compromise
Apply the Android November 2021 security patch or update to the latest upstream Linux kernel version
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
For Android devices, ensure the security patch level is 2021-11-01 or later. For Linux servers, upgrade the kernel package using your distribution's package manager.
# For Debian/Ubuntu systems
sudo apt-get update && sudo apt-get install --only-upgrade -y linux-image-generic
# For RHEL/Rocky Linux systems
sudo dnf clean all && sudo dnf update -y kernel
# Reboot to apply the new kernel
sudo reboot2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict local compiler access to prevent the compilation of public exploit payloads.
# Restrict compiler access for non-privileged users
sudo chmod 700 /usr/bin/gcc /usr/bin/clang 2>/dev/null || true3. Log Audit & IoC Verification Commands
Use the following script to check the running kernel version and inspect system logs for potential exploitation attempts.
#!/bin/bash
CURRENT_KERNEL=$(uname -r)
echo '[*] Running Kernel:' $CURRENT_KERNEL
# Check system logs for af_unix or UAF related crashes
sudo dmesg | grep -Ei 'use-after-free|af_unix|unix_scm_to_skb'Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A Use-After-Free (UAF) vulnerability exists in the unix_scm_to_skb function of net/unix/af_unix.c in the Linux kernel. The root cause is a race condition between the garbage collection process handling inflight socket file descriptors and the concurrent transmission of file descriptors via AF_UNIX sockets. This synchronization failure allows an attacker to reference a socket object after it has been freed.
2. Exploitation Mechanics & Attack Scenario
An attacker can trigger this vulnerability by spawning multiple threads to send file descriptors via SCM_RIGHTS over AF_UNIX sockets and concurrently closing them to trigger garbage collection. If the garbage collector decrements the reference count and frees the socket while unix_scm_to_skb is still processing the socket buffer (sk_buff), a Use-After-Free state is achieved. This can be exploited locally to execute arbitrary code in kernel space without user interaction.
3. Infrastructure & Business Impact
This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog. Successful exploitation allows a local attacker to bypass sandbox boundaries and escalate privileges to System execution level, compromising the integrity and confidentiality of the entire operating system.
Official Vendor Advisories & References
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel
Frequently Asked SecOps Questions (CVE-2021-0920)
FAQQ1. How critical is CVE-2021-0920 and is it actively exploited in the wild?
CVE-2021-0920 is rated CVSS 6.4 (MEDIUM) with a 30-day EPSS exploitation probability of 0.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-0920?
Primary impacted vendors include google, linux across android, linux_kernel. Scope summary: Android Kernel and Linux Kernel versions prior to the November 2021 security updates
Q3. What temporary mitigations or workarounds exist for CVE-2021-0920 before patching?
[Mitigation] Apply the Android November 2021 security patch or update to the latest upstream Linux kernel version Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-0920
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (google)
View Category →Android Integer Overflow Local Privilege Escalation and Code Execution Vulnerability (CVE-2025-48595)
[Affected Scope] Multiple components within the Android Operating System (OS)
Linux Kernel IPv6 Socket Memory Corruption Vulnerability (CVE-2026-53362) Analysis and Mitigation Guide
[Affected Scope] Linux kernel systems utilizing UDPv6 sockets with MSG_MORE and MSG_SPLICE_PAGES flags
Linux Kernel algif_aead In-place Operation Vulnerability Leading to Local Privilege Escalation (CVE-2026-31431)
[Affected Scope] Systems running Linux kernel with the `algif_aead` crypto subsystem module enabled.
Google Chrome Dawn Use-After-Free Vulnerability (CVE-2026-5281) Technical Advisory
[Affected Scope] Google Chrome versions prior to 146.0.7680.178
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.