CVE-2021-39634

What it actually does

Use-after-free condition in the eventpoll subsystem of the Linux kernel allows a local process to access freed memory structures and execute arbitrary code with kernel privileges.

Why it matters to the business

Devices running affected Android kernels can be fully compromised by any local attacker or malicious application, leading to data theft, persistence, and complete loss of device control.

How an attack unfolds

An attacker with local access repeatedly creates and manipulates eventpoll file descriptors in a specific sequence that triggers the use-after-free; the freed object is then reused to corrupt kernel data structures and redirect execution to attacker-controlled code, achieving root privileges without user interaction.

How to fix it

Apply the upstream kernel fix referenced by Android ID A-204450605 and update to a patched Android kernel build; where feasible, enforce SELinux policies and restrict untrusted local code execution until updates are deployed.

How to confirm the fix worked

Confirm the presence of the upstream commit that addresses the eventpoll use-after-free in fs/eventpoll.c and verify that running kernel builds incorporate the corrected code; test by attempting to reproduce the original race condition under a hardened configuration.

Typical attack path

1. Obtain local code execution via an unprivileged app or shell
2. Trigger repeated eventpoll create/modify/close operations to induce use-after-free
3. Spray or reuse the freed kernel object to corrupt internal structures
4. Redirect control flow to execute payload with elevated privileges
5. Establish persistence or exfiltrate data from the compromised device

How to detect it

Review kernel audit logs and system call traces for unusual patterns of eventfd and epoll_create/epoll_ctl/epoll_wait sequences originating from untrusted processes; correlate with sudden privilege changes or unexpected kernel oops messages.

What your security team should do

• Prioritize kernel updates for all Android devices as soon as vendor patches become available
• Monitor EPSS and exploit maturity indicators for any rise in in-the-wild usage
• Restrict installation of untrusted applications and limit local shell access on high-value devices
• Review device fleet for outdated Android kernel versions and schedule phased remediation