Yes. CISA added CVE-2021-0920 to its Known Exploited Vulnerabilities catalogue on 23 May 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Android kernel contains a race condition, which allows for a use-after-free vulnerability. Any organisation running the affected product should treat remediation as urgent.
What this CVE means for real-world exposure
CVE-2021-0920 is not just a theoretical Android kernel defect. A race condition in kernel code can create timing windows where memory is reused incorrectly, which is why use-after-free issues are often treated as high-risk exploitation paths. For defenders, the practical question is whether any managed or unmanaged Android devices in the estate are still exposed and able to receive fixes.
For mobile fleets, the first step is to identify which device classes, OS builds, and vendor update channels are in scope. A kernel flaw is harder to compensate for at the application layer, so exposure usually depends on patch availability and device-level control more than on user behaviour.
Why active exploitation changes the response
When a vulnerability is in the CISA Known Exploited Vulnerabilities catalogue, the response shifts from ordinary hygiene to urgent remediation. The right priority is not whether the flaw is interesting, but whether the affected Android builds are still present anywhere in production, BYOD, contractor, kiosk, or legacy device populations.
That urgency is why exploitability at the kernel layer matters. Kernel memory corruption can support privilege escalation or deeper device compromise, so even a narrow race condition can have an outsized impact if the attacker can land code execution or chain it with another weakness. Mobile Device Security Guide
What to do when patching is not immediate
If remediation must wait for a vendor update or carrier approval, reduce the attack surface around the exposed devices. That usually means tightening mobility management policy, removing unnecessary high-risk apps, limiting sideloading, and reducing the chance that an exploited device can reach sensitive services or trust stores.
For organisations that rely on Android endpoints, this is also the point to decide whether the device is allowed to remain connected at all. If the device cannot be patched promptly and it handles privileged data or internal access, isolate it or remove it from managed access paths until the fix is applied.
Risk and Threat Considerations
An actively exploited kernel race condition creates both exposure and compromise risk. The main concern is not only initial exploitation, but the downstream value of a device-level foothold on a mobile endpoint that may already hold corporate mail, VPN, SSO, or app tokens.
Failure mechanism: The race condition can trigger use-after-free behaviour in kernel memory management, creating an opportunity for code execution, privilege escalation, or stability loss depending on how the flaw is chained.
Impact: Successful exploitation can compromise the device, expose credentials or session material resident on it, and give an attacker a durable foothold on a trusted endpoint that may bypass ordinary app-layer controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation makes rapid vuln triage and remediation central. |
| Recommendation — Prioritise and remediate exposed Android devices using continuous vulnerability management. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The question is about urgent remediation of a known exploited vulnerability. |
| RA-5 — Vulnerability Monitoring and Scanning | Confirming whether vulnerable devices remain exposed requires ongoing scanning and inventory. | |
| Recommendation — Patch the affected Android kernel flaw promptly and track remediation status. Scan the device fleet to verify which Android systems remain vulnerable. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset vulnerabilities are identified and documented | The answer depends on knowing where the vulnerable Android builds exist. |
| PR.PS-03 — Configuration management is performed consistent with policies | Mobile patching and managed update enforcement are the practical control path. | |
| Recommendation — Identify and document all exposed Android assets before prioritising response. Enforce compliant mobile configuration and update state across Android devices. | ||
Practitioner Guidance
What to prioritise: Build a live inventory of Android devices that are still within the vulnerable support window, then sort them by business criticality and access level. Devices used for administrative access, email, and internal apps should be treated first.
What to verify: Confirm that remediation is not only available, but actually deployed across enrolled devices. Check for stragglers such as offline devices, deferred updates, and unmanaged BYOD endpoints that may never have received the patch.
Decision rule: If the device cannot be patched quickly and it has access to sensitive systems, assume the exposure is material and restrict or revoke that access until the device is brought back into compliance.
Practitioner takeaway: For an actively exploited mobile kernel flaw, the real security decision is whether any exposed device still has trusted access, because that determines how much blast radius the vulnerability can create before the patch lands.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org