Samsung KNOX Kernel UAF Exposes Millions of Galaxy Devices


Samsung KNOX Kernel UAF Exposes Millions of Galaxy Devices

Pierluigi Paganini
June 23, 2026

Samsung’s KNOX flaw (CVE-2026-20971) is a kernel UAF in PROCA/FIVE that can enable corruption via a race; Samsung patched it in Jan 2026.

Experts found a nasty kernel flaw in Samsung’s KNOX stack, and the uncomfortable part is where it lived: inside the software designed to raise the bar for attackers. CVE-2026-20971 is a use-after-free in the interaction between PROCA and FIVE, two kernel-side subsystems that help Samsung validate process integrity.

The bug sits in a race. FIVE tracks a process through a task_integrity object, and when a process changes state, such as by forking or calling execve(), the old integrity object gets dropped and a new one takes its place. That handoff should be clean, but Android’s preemptive kernel gives an attacker just enough breathing room to hit the gap. One thread can read a pointer, get suspended, and then come back to use memory that’s already been freed.

That’s the core problem LucidBit Labs describes: 

The target task executes execve(), specifically task_integrity_put(old_tint), freeing the original struct.  The next step is just as bad: “proc_integrity_value_read() resumes and calls task_integrity_user_read() with a pointer to freed memory. 

“While relatively straightforward, the race window is tiny – the process running proc_integrity_value_read() needs to be scheduled out just at the right time (within a window consisting of a couple of opcodes), and be scheduled out for long enough to gain control of the memory.” states the report published by Lucidbit Labs

Once that happens, the bug is no longer a theory. It’s a live UAF with a real corruption path.

Samsung’s KCFI helps, but it doesn’t save the day. It narrows the abuse surface by blocking arbitrary function calls, which is good news, but not enough to kill the flaw. The researchers still found a route by making the process load a file that can’t be executed, a non-ELF file, which removes the reset_file refcount blocker. From there, reallocate the freed memory in a fully controlled manner. That’s the kind of sentence that makes kernel engineers reach for coffee.

This wasn’t an academic stunt. LucidBit Labs says the issue could be triggered from an untrusted app and could lead to kernel memory corruption, which is exactly the sort of foothold attackers love.

“The vulnerability could be exploited from any untrusted app, and allowed attackers to obtain multiple memory corruption primitives, potentially leading to complete device takeover.” continues the report.

Samsung fixed it in the January 2026 update, and the affected range is broad: Galaxy S9 through Galaxy S25, plus A-series devices and both Exynos- and Qualcomm-based models across Android 13, 14, 15, and 16.

Samsung’s own advisory frames the issue as improper input validation in SecSettings before SMR Jan-2026 Release 1, and it notes that local access plus user interaction are required. That sounds less scary until you remember how often “local” really means “one careless tap away” on a device people trust with everything. Lost phones, borrowed phones, unattended phones, sold phones that weren’t fully wiped. The attack surface gets bigger fast.

The more interesting lesson is broader than one Samsung bug. Security controls don’t get a free pass just because they’re labeled defensive. If they sit in the kernel, inspect process state, or mediate trust decisions, they’re part of the attack surface too. Defenders don’t get to assume the guardrail can’t be used as a handhold. That assumption gets expensive.

This case also fits a pattern enterprise defenders know too well. A flaw that starts as a mobile kernel issue can still matter to the business if a staff device is compromised and the attacker uses it as a launch point into the network. Mobile endpoints are always on, usually trusted, and often less watched than laptops. That’s a bad combo. The punchline is simple: patch fast, and don’t treat security tooling as if it’s automatically safe just because it’s called security.

“Modified code, especially one related to complex mechanisms, is always an interesting area to look for vulnerabilities in. FIVE is a part of the Samsung KNOX security suite, and as we saw, protections can increase the attack surface.” concludes the report. “This research also demonstrated common difficulties related to kernel exploitation of race conditions – short race windows combined with the need to reallocate freed memory in a different cache. It also shows how kernel CFI was a highly effective mitigation in this case, practically blocking an arbitrary call primitive. In spite of that, other powerful primitives did exist.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2026-20971)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


I am a recent convert to physical media — yet even as someone getting back into buying discs in 2026, I haven’t been buying Blu-rays. Like many Americans, I still pick up DVDs instead. These aren’t great times for the Blu-ray format, and don’t expect a turnaround in 2026.

Fewer new releases make their way to Blu-ray

More media is now released exclusively for streaming

Blu-ray has been around for two decades, but it never managed to fully replace, or even overtake, the DVD format it was designed to supersede. We still can’t take for granted that our favorite movies, let alone TV shows, will eventually see a Blu-ray release.

The movies most likely to come to Blu-ray are the ones that hit theaters, but a growing amount of cinema is designed exclusively with streaming platforms in mind. I recently rewatched Mississippi Masala, which led me to check in on what work Sarita Choudhury has done over the decades since. A film called Evil Eye released in 2020 caught my eye. Unfortunately, it’s only available via Prime Video. There’s no Blu-ray or even a DVD. In contrast, it’s easy to watch Michael B. Jordan in Sinners on Blu-ray, since that movie came to theaters last year.

You could say that it makes sense that a movie with a 4.8/10 rating on IMDb doesn’t see a physical release, but in the heyday of physical video, store shelves were stacked not only with just the big-budget bangers but plenty of straight-to-DVD movies as well. Now those films exist to pad out streaming catalogs instead.

Fewer big box stores stock their shelves with physical discs

Blu-ray discs have disappeared from some stores entirely

Best Buy store front
Best Buy

The format’s demise is striking. I frequent my local Best Buy quite often and don’t see any movies on display. That’s because the retailer stopped selling movies in stores several years ago. Walmart still sells them, but the selection is a fraction of what you could find ten or twenty years ago. The audience has been reduced down to the shrinking number of people whose internet at home can’t handle streaming and those who might think of themselves as collectors.

If you venture onto Reddit and visit r/Blu-ray, you will find more threads about thrift store hauls and older collections than excitement over the latest new release. Don’t get me wrong — I, too, am very excited about seeing what gems I can snag for only a couple bucks, but this shows the challenge retailers face. Increasingly, only enthusiasts are prepared to drop over $20 on a disc.

I’m not buying discs to stick them in a player

Phone on a stand playing a Netflix video Credit: Bertel King / How-To Geek

The simple truth is that most people don’t want to buy physical media. Discs don’t fit in phones, and the drives are no longer available in most laptops. Even desktop PCs lack a place to put a disk. I recently built a PC for the first time in part to digitize my media library, and I rely on an external DVD drive connected via USB. Yes, DVD, not Blu-ray. A smaller file size combined with upscaling is easier on my hard drive.

Retro nostalgia hasn’t helped Blu-ray in the same way it has aided vinyl. This is in part because most people simply don’t care all that much about video quality. Most are streaming video on Netflix and YouTube at middling settings on small screens, and many of us are acclimated to mid-range phone speakers, compared to which even the subpar built-in speakers on modern TVs sound like a huge step-up. It’s hard to convince large numbers of people to purchase an expensive version of a movie in a format that requires thousands of dollars of home media equipment to truly appreciate.

4K Ultra HD is in an even worse position

It’s been a decade, yet few people own these discs

The 4K Ultra HD Blu-ray format is an enhancement, rather than a replacement, of the Blu-ray discs that first appeared in 2006. Debuting in 2016, the 4K Ultra HD format supports the max resolution of a 4K TV.

4K TVs were still somewhat of a novelty ten years ago, but they’re cheap and commonplace today. Still, people aren’t demanding 4K-quality Blu-ray movies as a result. These discs are still less common than 1080p ones, which are themselves still outnumbered by DVDs.

This isn’t merely a matter of consumers preferring the cheaper option. Often, 4K simply isn’t a choice, or it’s one that arrives significantly later, like the Switch port of a PC title. Some recent films, like Exit 8, are slated to see a physical release over the summer yet will still be in 1080p when they do. Adoption of the newest format has been that slow.

The industry isn’t helping itself, either. 4K Ultra HD Blu-ray discs come with DRM and aren’t easy to play on a modern PC, further limiting potential growth. They do not want anyone pirating these super high-quality versions. When you consider that some of these 4K Blu-rays have an AI upscaling problem, you’re paying more for what may not even be the best version.​​​​​​​


Blu-ray is seeing fewer releases, is available in fewer places, and is less accessible in the ways many of us want to watch TV shows and movies in 2026. With our portable devices getting better and internet speeds getting faster, it’s hard to see physical video staging a turnaround, even if we’re still a long way off from it going away entirely.



Source link