Use-After-Free in Samsung KNOX PROCA/FIVE

CVE-2026-20971 is a local kernel use-after-free vulnerability in Samsung's KNOX security framework, specifically in the PROCA driver and its interaction with the FIVE integrity subsystem, affecting devices prior to SMR Jan-2026 Release 1. Reporting indicates the flaw is caused by a race condition during process integrity state transitions such as fork or execve(), where a task_integrity object can be freed while another code path continues to reference it. In the described vulnerable flow, the old integrity object is released during replacement, after which procfs-backed read paths such as proc_integrity_value_read() or proc_integrity_label_read() may continue operating on the dangling pointer. Researchers reported this can produce multiple exploitation primitives, including kernel memory disclosure and constrained corruption, with controlled reallocation of the freed object possible under certain conditions. Although Samsung kernel mitigations such as KCFI reduce some control-flow exploitation paths, the vulnerability can still lead to practical kernel memory corruption and potential arbitrary code execution from a local untrusted application.