Samsung KNOX Use-After-Free Flaw Enabled Kernel Attacks on Galaxy Devices

Researchers at LucidBit Labs disclosed CVE-2026-20971, a high-severity use-after-free flaw in Samsung’s KNOX framework that left millions of Galaxy devices exposed to potential kernel-level attacks for roughly eight years. The bug affected Galaxy S9 through S25 models, tested A-series devices including the A54, and both Exynos and Qualcomm variants across Android 13, 14, 15, and 16. Samsung said the issue was fixed in its January 2026 Android security update, and users were urged to verify a security patch level of 2026-01-01 or later.

The vulnerability was traced to a race condition between KNOX’s PROCA process authenticator and the FIVE kernel integrity subsystem, specifically involving procfs handlers under /proc/pid/integrity/ that accessed a task_integrity object without a proper reference in a fully preemptive kernel. LucidBit said the flaw could let a local untrusted app trigger kernel memory corruption and identified exploitation primitives including a memory leak that could aid KASLR bypass, an arbitrary-call path mitigated by KCFI, and a constrained write through spinlock operations on reclaimed memory. Although exploitation required local access and user interaction, researchers warned that a compromised Galaxy device could still enable deeper device takeover and provide a foothold for attacks against enterprise environments.