Which products and versions are affected by CVE-2021-1048?

Affected: Android (Google) versions >= Android kernel; linux (debian); rootio-linux, among others. The full list is in the CVE brief.

Is CVE-2021-1048 being exploited in the wild?

It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Nov 6, 2021.

Is CVE-2021-1048 in the CISA KEV catalog?

Yes. It was added on May 23, 2022 with a federal remediation due date of Jun 13, 2022.

Is there a public exploit for CVE-2021-1048?

Public exploit code is available.

Is there a fix for CVE-2021-1048?

Fixed versions are available, including :linux_kernel: :2021-11-06, kernel-uek 4.1.12-124.59.1.2.el6uek, kernel-uek 4.1.12-124.59.1.2.el7uek.

How urgently should CVE-2021-1048 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2021-1048

HighExploitedPublic exploit

In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free.

Published Nov 4, 2021 · Updated Oct 15, 2026 · Also known as A-204573007, ASB-A-204573007, DEBIAN-CVE-2021-1048, TR-21-0890, UBUNTU-CVE-2021-1048

Key Facts

Patch immediately

CVE-2021-1048 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Android (Google), linux (debian), rootio-linux and 22 more products.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Nov 6, 2021. Public exploit code is available.
EPSS estimates a 1.1% probability of exploitation in the next 30 days.
Fixed versions are available, including :linux_kernel: :2021-11-06, kernel-uek 4.1.12-124.59.1.2.el6uek, kernel-uek 4.1.12-124.59.1.2.el7uek.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

1.1%

Higher than 63.8% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2021-1048 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-204573007References: Upstream kernel

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CISA KEV	May 23, 2022	Jun 13, 2022	Not reported
Industry KEV feed	Nov 6, 2021	Jun 13, 2022	Not reported
CIRCL KEV	May 23, 2022	Jun 13, 2022	Not reported
ENISA EUVD	May 23, 2022	n/a	Not reported

Required action: Apply updates per vendor instructions.

Affected Products

73 affected entries in total

Product	Affected versions	Fixed in
AndroidGoogle	>= Android kernel	n/a
linuxdebian	See advisory	5.8.10-1
rootio-linuxrootio	See advisory	5.8.10-1
linux-awsubuntu	See advisory	4.15.0-1088.93
linux-aws-5.0ubuntu	See advisory	n/a

20 more affected products in the full CVE brief