Samsung Patched CVE-2026-20971 Kernel Flaw Affecting Galaxy Devices

Summary

Researchers say CVE-2026-20971 is a KNOX kernel use-after-free affecting multiple Samsung device generations. Samsung patched it in January 2026; its advisory says local exploitation requires user interaction.

Key points

LucidBit Labs reported CVE-2026-20971, a CVSS 7.8 flaw affecting Samsung Galaxy S9–S25 and A-series devices, including Exynos- and Qualcomm-based models.
Researchers traced the flaw to a race condition in the interaction between Samsung’s PROCA process authenticator and FIVE integrity subsystem, resulting in a use-after-free.
LucidBit Labs says an untrusted app could trigger the flaw, potentially causing kernel memory corruption and providing a path to deeper device control.
Kernel control-flow integrity limited some exploitation options but did not eliminate the use-after-free, according to the researchers.
Samsung’s advisory says the issue allows a local attacker to access a file with system privileges and requires user interaction; it lists Android 13–16 as affected.
Samsung fixed the vulnerability in its January 2026 security update.

Article Details

Vulnerability Types: Race condition
Use-after-free
Severity: High (CVSS 7.8)
Affected Versions: Samsung devices running Android 13
Samsung devices running Android 14
Samsung devices running Android 15
Samsung devices running Android 16
Samsung Galaxy S9 through Galaxy S25
Samsung Galaxy A-series devices
Exploitation Status: reported
Exploit Availability: unknown
Patch Status: available

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThe reported local exploit could use the kernel use-after-free to reach system privilege or deeper control of a Samsung device.

Vendors

SamsungResearchers found an eight-year old high severity vulnerability affecting nearly all Samsung devices from the Galaxy S9 to S25 living within the KNOX kernel.

Products

AndroidThis should be instantaneous – but enter Android’s preemptive Kernel within which it all runs.FIVEThe flaw (CVE‑2026‑20971, CVSS 7.8) could be exploited through the interaction between PROCA and FIVE.Galaxy S9Researchers found an eight-year old high severity vulnerability affecting nearly all Samsung devices from the Galaxy S9 to S25 living within the KNOX kernel.KNOXResearchers found an eight-year old high severity vulnerability affecting nearly all Samsung devices from the Galaxy S9 to S25 living within the KNOX kernel.PROCAThe flaw (CVE‑2026‑20971, CVSS 7.8) could be exploited through the interaction between PROCA and FIVE.Samsung Galaxy S25This issue existed across multiple Samsung device generations, including Galaxy S9 through Galaxy S25, A-series devices, and both Exynos- and Qualcomm-based models.